Re: [gentoo-security] Re: Is anybody else worried about this?

[Rui Covelo <rpfc@mega.ist.utl.pt>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1





Peter Simons wrote:
| This problem has nothing to do with trusted or untrusted
| code, it is about data integrity. Or, more accurately, about
| _lack_ thereof.

Security is always about trust. You have to trust someone or something.
Data, keys, servers, admins, protocols, passwords, algorithms, something...


|  > (1) the server has not been compromised
|
| How do I very this? Is there a list of SHA1 hashes of all
| files /usr/portage is supposed to contain?

Where would you store that list? In a trusted server? Would you trust
the server admin of that server?


|  > (3) the server operator is trustworthy
|  > (4) the person that originally created the software is trustworthy
|  > (5) the server operator's are sufficiently skilled to protect the
software
|  > (6) the person that originally created the software is suffciently
skilled
|  >     to protect it
|
| None of these points are relevant for the problem we are
| talking about. If Gentoo provides proper means of
| authenticating the data I receive from the mirror, I don't
| _need_ to trust the mirror's operator.

You need to trust the operator of the authentication server...


|  > However, none of those issues is specific to Gentoo or
|  > Open Source as a whole.
|
| The fact that other projects have the same problem doesn't
| mean that the problem shouldn't be fixed in Gentoo.

Agreed! This issue is important.


|  > IMO the purely technical issues have been solved mostly.
|  > However, those are smallest and least important part.
|
| So how long will it (approximately) take until this problem
| is fixed?

Well... I guess until someone comes up with a solution! Not the problem!
The problem is already known. Gentoo is based on the comunity. The
comunity has to come up with solutions. Not wait for highly payd
developers to solve everything like in some known corporations. At least
~ this is how I see Gentoo. Maybe I'm wrong...


Alex's ideia looks interesting:
| Just a question : could it be a good idea to move md5 on another server
| or to do 'emerge sync' asking for files on server A and digest files on
| server B where server B is any server in gentoo rsync rollover but not
| server A...
|
| Then, person have to compromise server A and server B to get his hack
| working...
|
| Hope this help
|
| Cheers

Redundancy could be a way to mitigate this problem. It wont solve it thou...



- ---
Rui Covelo




-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBjkMQfLPhlaxNQk0RAvogAJ4o8042MBgvnqsp525orqXMfOn5/ACfR2Nb
5VmAOoUrvQAIRqmvg5khvB0=
=5aGG
-----END PGP SIGNATURE-----

--
gentoo-security@gentoo.org mailing list