Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Andrew <afrayedknot AT thefrayedknot.armory.com>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors
  • Date: Thu, 8 Sep 2005 13:57:57 -0700

On Thu, Sep 08, 2005 at 09:43:07PM +0200, Ladislav Hagara wrote:
> We know nothing about application developer's signing policy.

Thats not necessarily true and is a poor assumption to be making.

> Their web
> site can be cracker, their private key can be stolen.
> Lets go to download new repackage of xyz with good signature with "rm
> -rf /*". Our hash can help to prevent it.

You've made this argument several times, and I've made the same rebuttal
every time, and yet, gotten no response. So, here it is, once again.

If we keep the upstream signature *in the spell* and if the upstream
site is compromised the upstream signature will change and the signature
we have will fail.

Furthermore, hashes are no holy grail by any stretch (gpg is a wrapper
around hashes btw), history tells us that when the upstream vendor
changes their code un-announced, we do a cursory check to see if we're
getting what we're supposed to, then change the hash/sig/whatever to
match. Hows that for hashes preventing upstream compromises? The problem
has nothing to do with the underlying verification technology.

-Andrew

--
__________________________________________________________________________
|Andrew D. Stitt | astitt at sourcemage.org |
|irc: afrayedknot | afrayedknot at t.armory.com |
|aim: thefrayedknot or iteratorplusplus | acedit at armory.com |
|Sorcery Team Lead | ftp://t.armory.com/ |
--------------------------------------------------------------------------

Attachment: pgp_LloRRQ_xC.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page