From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 324631381F3 for ; Mon, 9 Sep 2013 07:19:51 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 89F30E0AB9; Mon, 9 Sep 2013 07:19:46 +0000 (UTC) Received: from mail-wg0-f48.google.com (mail-wg0-f48.google.com [74.125.82.48]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 5FBBCE0AA5 for ; Mon, 9 Sep 2013 07:19:45 +0000 (UTC) Received: by mail-wg0-f48.google.com with SMTP id n12so2461113wgh.3 for ; Mon, 09 Sep 2013 00:19:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=jIcNIqMUYdx3v8NvgDr3HJ7Vw7AzboeHfggfyxy5zac=; b=VF73q8s44Tzk6G8rVx/JIQPifEWDwCKdcTRguiGDuMzFtZ2VUlJUW3C0VHK+BHDH9h WWWpNyhN2w5k18Z6yXadF1bdlAZxqg+soupj26xY5USFeQZQZ/xaferb0usbiFEmic1G HDRfgSRfP6s2PvYdY3mH44Ys0I1AOII6UYyfkOWg+nYHIhi/19g9ewavVc3gT+SOL9ru x2xRS8dCewYZtGVRSuHLFyNFDZ+sMRUrCYPCm9owHYPEXpmRuvDEUw6jKaZp3HQ8CVlk ptQpG8A3XZXWpT0Lko8L/z/afVZXO+PsqFHORxbxOwh0e8K7QIa8FXeoccw7Jy5aG65K tbOw== Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@lists.gentoo.org Reply-to: gentoo-user@lists.gentoo.org MIME-Version: 1.0 X-Received: by 10.180.185.77 with SMTP id fa13mr7220284wic.58.1378711183887; Mon, 09 Sep 2013 00:19:43 -0700 (PDT) Received: by 10.194.11.38 with HTTP; Mon, 9 Sep 2013 00:19:43 -0700 (PDT) In-Reply-To: <522D2D05.1000400@orlitzky.com> References: <522D257C.5060902@gmail.com> <522D2D05.1000400@orlitzky.com> Date: Mon, 9 Sep 2013 11:19:43 +0400 Message-ID: Subject: Re: [gentoo-user] Internet security. From: Pavel Volkov To: gentoo-user@lists.gentoo.org Content-Type: multipart/alternative; boundary=001a11c243165d141104e5ee3623 X-Archives-Salt: 4ef83543-bcc3-4d8f-8c6e-24b4b9265ae5 X-Archives-Hash: 5475653bfee13b02753abfff653e6fcf --001a11c243165d141104e5ee3623 Content-Type: text/plain; charset=ISO-8859-1 On Mon, Sep 9, 2013 at 6:05 AM, Michael Orlitzky wrote: > The CA infrastructure was never secure. It exists to transfer money away > from website owners and into the bank accounts of the CAs and browser > makers. Security may be one of their goals, but it's certainly not the > motivating one. > Well, at least CAcert doesn't exist for money. > > To avoid a tirade here, I've already written about this: > > [1] > > http://michael.orlitzky.com/articles/in_defense_of_self-signed_certificates.php > > [2] > > http://michael.orlitzky.com/articles/why_im_against_ca-signed_certificates.php > > I've got a question about Gentoo in this case. If we assume that stage3 is trusted, does portage check that mirrors are trusted? I'm not sure about this. But if it does, then distfiles checksums are also checked, so they are trusted, too. In this case you could trust a running browser. Until your system becomes compromised in other ways. This would be OS packaging system problem, not the problem with CA-->user trust model. --001a11c243165d141104e5ee3623 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
On Mon, Sep 9, 2013 at 6:05 AM, Michael Orlitzky <mich= ael@orlitzky.com> wrote:
The CA infrastructure was never secure. It exists to transfer mon= ey away
from website owners and into the bank accounts of the CAs and browser
makers. Security may be one of their goals, but it's certainly not the<= br> motivating one.

Well, at least CAcert d= oesn't exist for money.
=A0

To avoid a tirade here, I've already written about this:

[1]
http://michael.orlitzky.com/articles/in_= defense_of_self-signed_certificates.php

[2]
http://michael.orlitzky.com/articles/why_= im_against_ca-signed_certificates.php


I've got a question about Gentoo i= n this case. If we assume that stage3 is trusted, does portage check that m= irrors are trusted? I'm not sure about this. But if it does, then distf= iles checksums are also checked, so they are trusted, too. In this case you= could trust a running browser. Until your system becomes compromised in ot= her ways.
This would be OS packaging system problem, not the problem with CA--&g= t;user trust model.
--001a11c243165d141104e5ee3623--