Stephen John Smoogen <smooge <at> gmail.com> writes: > There is a specific "named" fallacy to that logic. I can't remember > the mathematical name for it, but basically the issue is that having > multiple sources doesn't help if they all get their information from > the same top level source. Yeah, no kidding. The point of open source is supposed to be that more eyes see better. That's why we have package reviews, pre-release checks (alpha, beta, rc) and so on. You can never achieve 100% independence, of course. That's why we have bugs :-) > The big issue with multiple signatures is > that they are going to be automated somehow to deal with the thousands > upon thousands of packages being dealt with... If there is any chance of this being automated, it cannot work at all and there is no point doing it. > and you are going to > have to come up with an additional income source to pay for the extra > bureaucracy that is being added. True. All security has a price. > Or just be in the right place somewhere. More than one, actually. > The build systems will not be > completely independent or they would not be able to produce identical > binaries.. Say someone breaks into Fedora build system and subverts the process in such a way that there is their own gcc inserted just at the right time in order to produce the binaries they want. A package is built by the packager and a signed e-mail is sent to the signatories to sign it, because it's an update. Given this is a new update, another build system, located elsewhere and not publicly accessible, pulls in the package source and builds it. If that other system wasn't broken into, it will produce a different binary for sure. Immediate alarm bells for signatories. Sure, this is a difficult thing to do right. It doesn't fix all intrusion issues (nothing can). Takes a lot of effort etc. But it does provide at least some checks and balances before packages are swallowed by users out there. No offence, but right now we have a single point of failure that we already know can be cracked. And that single point of failure is the single point of users' trust. Not a very safe combo, IMHO. Never mind, it was just an idea. Probably not even a good one. Back to the drawing board... ;-) -- Bojan -- fedora-devel-list mailing list fedora-devel-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-devel-list
