sm-discuss AT lists.ibiblio.org
Subject: Public SourceMage Discussion List
List archive
Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors
- From: Andrew <afrayedknot AT thefrayedknot.armory.com>
- To: sm-discuss AT lists.ibiblio.org
- Subject: Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors
- Date: Wed, 31 Aug 2005 16:00:02 -0700
On Wed, Aug 31, 2005 at 06:43:24PM -0400, Sergey A. Lipnevich wrote:
> On Wed, 2005-08-31 at 09:51 -0700, Andrew wrote:
> > >
> > > Vendor signing is great but personally I would extra add our hash.
> > > What about if for example home page of wget is cracked, wget author's
> > > key is stolen, new tarball with "rm -rf /*" is created and signed?
> > >
> >
> > If you put the vendor's signature in the spell that can't happen.
> > Yes thats different than current suggestions for vendor signing, but
> > has come up elsewhere. No need to have extra guru supplied verification.
>
> If the vendor has a compromised key and is not doing anything about it,
> then removing their signature and replacing it with a good hash may be a
> solution.
Or signing the tarball ourselves...
-Andrew
--
__________________________________________________________________________
|Andrew D. Stitt | astitt at sourcemage.org |
|irc: afrayedknot | afrayedknot at t.armory.com |
|aim: thefrayedknot or iteratorplusplus | acedit at armory.com |
|Sorcery Team Lead | ftp://t.armory.com/ |
--------------------------------------------------------------------------
-
Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors
, (continued)
-
Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors,
Andrew, 08/31/2005
- Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors, Sergey A. Lipnevich, 08/31/2005
- Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors, Seth Alan Woolley, 08/31/2005
- Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors, Sergey A. Lipnevich, 08/31/2005
- Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors, Seth Alan Woolley, 08/31/2005
-
Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors,
Andrew, 08/31/2005
- Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors, Sergey A. Lipnevich, 08/31/2005
-
Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors,
Andrew, 08/31/2005
-
Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors,
Sergey A. Lipnevich, 08/31/2005
- Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors, Andrew, 08/31/2005
- Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors, Sergey A. Lipnevich, 08/31/2005
-
Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors,
Sergey A. Lipnevich, 08/31/2005
- Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors, Sergey A. Lipnevich, 08/31/2005
-
Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors,
Sergey A. Lipnevich, 08/31/2005
-
Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors,
Seth Alan Woolley, 08/31/2005
- Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors, Sergey A. Lipnevich, 08/31/2005
-
Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors,
Seth Alan Woolley, 08/31/2005
- Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors, Sergey A. Lipnevich, 08/31/2005
Archive powered by MHonArc 2.6.24.