Bill Davidsen wrote: > >> >> If the public/private key methods employed today are as easy to >> penetrate and subvert as some seem to be claiming then one has to >> question why it hasn't already been done. >> > It has already been proved to be possible, so discussion of how easy > it is or way is irrelevant, at least to me. ??? It has? So, what was done? Was the signing key of Fedora compromised? Was a replacement key public key generated and distributed? Were packages signed by the replacement key distributed? What was "proven". > > The new public key could be distributed from the master Red Hat > servers, not from mirrors, which would allow validation of the content > by the validity of the SSL certificate. Once a trusted signature is > available, all other packages, from mirror or torrent, could be > properly validated. "Could"...how? > > While this is inconvenient, it is also as secure as the original, and > not readily vulnerable to attacks in the distribution, since middlemen > are not involved. And once the key is out for a few days, and many > users have it and can quickly compare it to any other key distributed > by other means, then it can be sent out in a more convenient manner if > people really feel the need to trade some security for ease of use. > A whole bunch of people are wringing their hands over nothing. I suppose if you want to continue doing that that is your choice. The strange things is that none of this would have come up if the servers of Fedora hadn't been penetrated by some method which nobody on this list is privy to...but can spend endless hours on idle speculation and fear mongering. [WOT comment] I suspect that those fear peddlers, if located in the US, will also be voting for the Republican candidate. :-) -- Some people's mouths work faster than their brains. They say things they haven't even thought of yet. -- fedora-list mailing list fedora-list@xxxxxxxxxx To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines
