Fedora News Updates #1

[Andy Green]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wednesday 07 January 2004 12:40, Warren Togami wrote:

> For this reason everyone should sign absolutely everything.  While
> signatures alone don't protect you from malicious code or binaries, they
> help to create a paper trail.

Couldn't agree more... but the original point is that railing against doing a 
make as root is not going to solve anything when we are daily installing RPMs 
as root, signed or unsigned.  And as you point out, the signature is only an 
assurance that at some point the package was processed by somebody who had 
that private key.... it doesn't have anything to say about the untaintedness 
of the sources -- or the security of the signer's machines and key.

Unless you undertake to scour sources personally and install by compile only 
- -- something most people would reasonably consider an impossible burden -- 
you take on a risk by using binary packages, and its hard to see what can be 
done to mitigate that, especially when attacks inside RPM scripts could be 
very subtle and indirect.

- -Andy
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQE//AJsjKeDCxMJCTIRAkBUAJ0Yd/2VscGWGO4YoagNN9Bz2/pTUwCcD3g5
oNmNGl4yZgMs9N/gAzvc76Y=
=sBfk
-----END PGP SIGNATURE-----