[gentoo-dev] Re: [gentoo-security] Trojan for Gentoo/GNU Linux, proof of concept

[Paul de Vrieze <gentoo-user@devrieze.net>]

[-- Attachment #1: signed data --]
[-- Type: text/plain, Size: 1090 bytes --]

On Saturday 22 March 2003 12:20, MAL wrote:
>
> I don't think I would trust a security/paranoid only update system
> within portage, as portage will still be working with an externally
> generated list of to-do.  Building aan update locally, making sure it's
> only what you want, then packaging it, (ebuild package - tbz2 format),
> and installing it on the remote machine, is the only method i'd feel
> satisfied with.
>

I agree with your point of view. While my only "server" is a home server that 
does some printing and ip sharing stuff I do make sure I don't just update 
world. I don't see the point of "running emerge -u world from cron" at all. 
The best protection from instability is keeping record of the mailing lists, 
and not updating what is not broken.

For my desktops, I even there wait with updates for packages like gcc, glibc, 
X etc. until I believe they are actually stable in a sense that I don't hear 
about problems concerning them anymore.

Paul

-- 
Paul de Vrieze
Researcher
Mail: pauldv@cs.kun.nl
Homepage: http://www.devrieze.net

[-- Attachment #2: signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]