[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <550EB007.1030701@gmail.com>
Date: Sun, 22 Mar 2015 08:05:27 -0400
From: Daniel Micay <danielmicay@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE for Kali Linux
On 22/03/15 07:06 AM, Florian Weimer wrote:
> * Daniel Micay:
>
>> Is there actually a way for a Windows user to obtain it securely?
>
> I believe there are ideological objections to using an Authenticode
> signature (same as with Tor).
Tor provides their download via HTTPS from the same domain and has both
HSTS preloading and HPKP. They provide a link to a GPG signature for the
tarball too, but that doesn't help most users unless their distro is
using it in package sources. AFAICT they plan on doing Authenticode
signing, but they're doing a good job without it.
The problem with these Linux distro downloads is that it's consistently
done via http. That's fine for packages because package signing takes
care of it. It's fine if the download is done in a way that results in
verification like a torrent, but otherwise the user needs to manually
verify a hash or signature and that's rarely going to happen.
It's 2015 and Debian shouldn't have an HTTP download link for the ISO on
their front page :P.
Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
