Security bugs are reported here via bugzilla

[Seth Woolley <seth AT tautology.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This needs to be an option unless we are planning on letting people into
rsync over ssl or ssh or some other encrypted transport.  Optionally, we
can gpg sign the grimoire and have a gpg check of the grimoire consisting
of a nice tar, but then we'd need all permissions and dates to be the
same on both copies of the tar on the remote and local side.  We need some
way to ensure that updating isn't the weakest point of failure for a
man-in-the-middle attack when some SMGLers will be running an unverified
apache-mod_ssl (which is quite senseless).  I'm guessing stunnel is the
best route?  Port forwarding over ssh would require some sort of way for
people to log in via ssh, so I pick stunnel.  Let's just keep this in mind
for the future.  CVS has similar problems... does anybody know if
anonymous ssh access is feasable at all (I assume not)?

I was hoping we can use the development CVS box that's coming up soon for
moving to gpg-validated grimoires... but then I was planning on just
signing the whole tarball perhaps with an automated routine that I could
store the revocation key for in case the account gets compromised.  With
this incremental download philosophy, we can't do that easily.

I have another idea for incremental downloading that we can most likely
secure with gpg.  If we stored nightly patch files for the grimoire
updates, we can develop a simple update script that receives the epoc time
since last update in the url (update.cgi/grimoire-epocsince.tar.bz2).
The response would forward to the CGI script (update.cgi) again except it
would be to update.cgi/grimoire-epocsince-epocend.tar.bz2 returning a
tar.bz with all the patches since last update, include the epoc time (for
remembering what to send next time when asking for an update) in the
header, and also include gpg signatures for each incremental patch (or the
patches could be merged into one patch before sending).  Store the last
thirty days of patches, and if the time of update requested is longer than
thirty days, send the tar.bz of the whole grimoire with an epocsince of 0.
Have sorcery figure out what to do from there.  I volunteer to implement
this since I am suggesting it.  We could make the increment quite a bit
more fine than a day and still have relatively low processing overhead.

Anybody following me or am I just loopy?

Seth

On Wed, 11 Jun 2003, Hamish Greig wrote:

> On Wed, 11 Jun 2003 14:11, Eric Sandall wrote:
> > I have a request (one that I think is good) to have rsync for the grimoire
> > a high priority, as many have said, downloading 1.2MB+ for a few changes
> > (sometimes big changes, but almost never 1.2MB worth of changes) is
> > overkill, especially for those on slow modems.  This would also probably
> > please the Ibiblio people (and our other generous mirrors) as it would cut
> > down on the amount of bandwidth used.
> >
> > Thoughts?
> >
> > -sandalle
> I like this idea, especially as you could probably override rsync and 
> exclude
> local copies that you have updated but haven't been committed yet. That's if
> i understand rsync properly that is.
> I can't think of the times i have customised a spell in a regular grimoire 
> for
> a quick fix then forgotten to copy it to a custom grimoire and lost the work
> with a scribe update....!
> With an rsync precommand it would ask you what if any files to exclude 
> before
> it trashes all your work.
> I like this alot!
> Hamish
> --
> Do You SMuGL!?
> Linux so advanced it may as well be magic!
> Everything you'll ever need on one web page
> http://www.sourcemage.org/
>
> _______________________________________________
> SM-Grimoire mailing list
> SM-Grimoire AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-grimoire
>
> ------------ Output from gpg ------------
> gpg: Signature made Tue Jun 10 22:28:03 2003 PDT using DSA key ID 947AE36E
> gpg: Good signature from "Hamish Greig (hgg) <hgreig AT bigpond.net.au>"
> gpg: WARNING: This key is not certified with a trusted signature!
> gpg:          There is no indication that the signature belongs to the 
> owner.
> Primary key fingerprint: 76EC 39B2 0D2A F485 E9BD  4D27 F1F4 AE7D 947A E36E
>
>

- --
Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.0 (FreeBSD)

iD8DBQE+5trm7fQ833vqzH0RAvCLAJ9UoDUtM9tKU53mmW51OPGyA9ouvgCg4KbZ
ZYfow0REcPuoVnvCSxAb3cg=
=ZzkN
-----END PGP SIGNATURE-----