sm-discuss AT lists.ibiblio.org
Subject: Public SourceMage Discussion List
List archive
Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors
- From: Ladislav Hagara <ladislav.hagara AT unob.cz>
- Cc: sm-discuss AT lists.ibiblio.org
- Subject: Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors
- Date: Wed, 31 Aug 2005 18:51:56 +0200
The beauty of hashes is that they don't need any extra support in addition to
what's in sorcery now.
Moreover, if there is some integrity problem, even users can discuss about their hashes, they can easily compare them.
In p4 reviews I see ascii changes, not only "binary file was changed".
Vendor signing is great but personally I would extra add our hash.
What about if for example home page of wget is cracked, wget author's key is stolen, new tarball with "rm -rf /*" is created and signed?
--
Got yourself a ledger.sourcemage.org account?
http://ledger.sourcemage.org/
Ladislav Hagara
Source Mage GNU/Linux Developer
http://www.sourcemage.org/
-
Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors
, (continued)
-
Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors,
Sergey A. Lipnevich, 08/31/2005
-
Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors,
Andrew, 08/31/2005
-
Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors,
Sergey A. Lipnevich, 08/31/2005
-
Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors,
Andrew, 08/31/2005
- Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors, Sergey A. Lipnevich, 08/31/2005
- Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors, Seth Alan Woolley, 08/31/2005
- Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors, Sergey A. Lipnevich, 08/31/2005
- Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors, Seth Alan Woolley, 08/31/2005
-
Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors,
Andrew, 08/31/2005
-
Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors,
Sergey A. Lipnevich, 08/31/2005
-
Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors,
Andrew, 08/31/2005
-
Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors,
Jeremy Blosser (emrys), 08/31/2005
- Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors, Sergey A. Lipnevich, 08/31/2005
-
Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors,
Sergey A. Lipnevich, 08/31/2005
-
Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors,
Andrew, 08/31/2005
-
Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors,
Sergey A. Lipnevich, 08/31/2005
- Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors, Andrew, 08/31/2005
- Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors, Sergey A. Lipnevich, 08/31/2005
-
Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors,
Sergey A. Lipnevich, 08/31/2005
- Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors, Sergey A. Lipnevich, 08/31/2005
-
Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors,
Sergey A. Lipnevich, 08/31/2005
- Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors, Seth Alan Woolley, 08/31/2005
Archive powered by MHonArc 2.6.24.