Re: [gentoo-security] Re: Trojan for Gentoo, part 2

[Kurt Lieber <klieber@gentoo.org>]

[-- Attachment #1: Type: text/plain, Size: 1237 bytes --]

On Sun, Nov 07, 2004 at 04:44:32PM +0100 or thereabouts, Peter Simons wrote:
> I think it is important to stress that everybody is on the
> same side here. The important thing right now is how to
> _fix_ this problem. As I see it, the simplest possible
> solution is this:
> 
>  (1) Run "find /usr/portage -type f | xargs sha1sum -b" on
>      the Gentoo main system.
> 
>  (2) Sign the output with GPG.
> 
>  (3) Put it into the portage tree.
> 
>  (4) If the user has GPG installed and has manually put the
>      appropriate public key in some place _outside_ of the
>      portage tree, have "emerge sync" verify that the
>      signature is intact and all hashes hold.
> 
> Done.


People place way to much reliance on GPG and other public/private key
systems...

Let's assume we implement the above steps.  What does that buy you?  How do
you know how many people have a copy of the private key used to sign that
data?  How do you know what sort of passphrase is used on it? (or if it
even has a passphrase)  How do you know the box that holds the private key
is secure?

Most importantly, how do you know when to stop?  At some point, you're
going to have to accept some level of risk.  

--kurt

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]