oss-security - Re: upstream source code authenticity checking

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <86ehdxlmvz.fsf@ds4.des.no>
Date: Fri, 26 Apr 2013 10:25:04 +0200
From: Dag-Erling Smørgrav <des@....no>
To: oss-security@...ts.openwall.com
Cc: kseifried@...hat.com,  Alistair Crooks <agc@...src.org>,  Josh Bressers <bressers@...hat.com>
Subject: Re: upstream source code authenticity checking

Kurt Seifried <kseifried@...hat.com> writes:
> This makes no sense. So you don't trust their signature because they
> have to "earn trust", but you do trust their software and you compile
> and run it? That's literally insane.

This is exactly the logic used by web browsers to justify scaring users
away from https sites that haven't payed the Verisign tax...

DES
-- 
Dag-Erling Smørgrav - des@....no

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.