Re: Severity of Failed checksum for PKGBUILD

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]



On Fri, Feb 20, 2015 at 4:09 PM, Daniel Micay <danielmicay@xxxxxxxxx> wrote:
> On 20/02/15 10:04 AM, Martti Kühne wrote:
>
> You should really just tell upstream to sign their releases, because it
> wipes out the attack vector instead of just making it possible to audit
> whether a MITM attack on the original. packager occurred like hashes.
>
> The hashes provide no security for the initial packaging work and no
> defense against an attack that's done by compromising the upstream
> sources, which is far more realistic than a targeted MITM attack on a
> specific Arch Linux packager.
>


Since security-by-reading-the-code isn't an option since a few
decades, we're stuck in this, yup.

cheers!
mar77i


[Index of Archives]     [Linux Wireless]     [Linux Kernel]     [ATH6KL]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Share Photos]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Samba]     [Device Mapper]
  Powered by Linux