Re: [gentoo-security] Re: Out of air

[Antoine Martin <antoine@nagafix.co.uk>]

On Wed, 2004-11-10 at 13:55 +0100, Klaus Wagner wrote:
> On Wed, Nov 10, 2004 at 12:54:44PM +0000, Antoine Martin wrote:
> > I think we all admit it may take some time, but we are talking about the
> > quick and dirty solution as a stop-gap measure, nothing else.
> > And if the better solution takes more than 1.5years to roll out, backup
> > plans are just common sense - not criticism.
> > 
> > 
> > I is just a cron job and a script, how would that double the amount of
> > work in the future?!?
> 
> I really don't see how this is greatly improving security.
> A cronjob, that is AUTOMATICALLY signing everything it get's
> wouldn't make me happy.
> 
> Security, is not only signation and cryptography.
> When it comes to signation, I have to trust every point
> in the process, and I don't trust cronjobs and "in memory"
> passphrases, or even worse unprotected private keys.
Sure, I agree with you. This is would not solve *all* problems.

But it would solve the problem that this thread started on, which is to
trust all the hops between your box and the gentoo servers. Which is a
greater risk than a compromised gentoo server.


--
gentoo-security@gentoo.org mailing list