Re: [gentoo-dev] Re: possible trojan in openssh-3.4p1

[Johannes Findeisen <you@hanez.org>]

> as far as the above suggestion made by Terje is concerned You're right.
> Distributed checks could easily lead to "confusion", especially working
> with mirrors. But MD5 alone IS a joke when it comes to _security_
> (here: proof of origin/unmodified developer version). It's quite good
> to check file corruption during data transfer. But that's it in my
> eyes. If one wants secure "origin" checks there's the need for gpg
> signing or something alike. Just using md5 someone who got write access
> to a portage-server could easily regenerate the sum and paste it into
> the ebuild including a modified SRC-URL.

yeah you're right. but AFAIK are the gentoo rsync mirrors being updated every 
30 minutes. so if anyone is interested in putting some hacked versions in 
there, he could do that but will destroy every changes after mirroring the 
portage tree again. hmmm... but you're right!!! all people who are providing 
mirrors are in the position to make such things.

well there are ways to do it but we have only one "master" of rsync servers so 
all the others will be updatet from this one. i think and hope it is this 
way...

trust no one
hanez... ;-)
-- 
begin  .signature
question: is it a feature to execute code in emails?
	i don't think so!
end