Public SourceMage Discussion List

[Andrew <afrayedknot AT thefrayedknot.armory.com>]

On Thu, Sep 08, 2005 at 09:43:07PM +0200, Ladislav Hagara wrote:
> We know nothing about application developer's signing policy.

Thats not necessarily true and is a poor assumption to be making.

> Their web 
> site can be cracker, their private key can be stolen.
> Lets go to download new repackage of xyz with good signature with "rm 
> -rf /*". Our hash can help to prevent it.

You've made this argument several times, and I've made the same rebuttal
every time, and yet, gotten no response. So, here it is, once again.

  If we keep the upstream signature *in the spell* and if the upstream
  site is compromised the upstream signature will change and the signature
  we have will fail.

Furthermore, hashes are no holy grail by any stretch (gpg is a wrapper
around hashes btw), history tells us that when the upstream vendor
changes their code un-announced, we do a cursory check to see if we're
getting what we're supposed to, then change the hash/sig/whatever to
match. Hows that for hashes preventing upstream compromises? The problem
has nothing to do with the underlying verification technology.

-Andrew

-- 
__________________________________________________________________________
|Andrew D. Stitt                           | astitt at sourcemage.org    |
|irc: afrayedknot                          | afrayedknot at t.armory.com |
|aim: thefrayedknot or iteratorplusplus    | acedit at armory.com        |
|Sorcery Team Lead                         | ftp://t.armory.com/         |
--------------------------------------------------------------------------

Attachment: pgp_LloRRQ_xC.pgp
Description: PGP signature