[svn.haxx.se] · SVN Dev · SVN Users · SVN Org · TSVN Dev · TSVN Users · Subclipse Dev · Subclipse Users · this month's index

Re: 1.2.0-rc2 tarballs up for testing/signing

From: Andrew Thompson <subversionuser_at_aktzero.com>
Date: 2005-04-22 20:22:21 CEST

kfogel@collab.net wrote:
> Andrew Thompson <subversionuser@aktzero.com> writes:
>
>>So you're assuming that the tarball you received is good, or you
>>pulled and created your own tarball?
>>
>>If yes to the first part, isn't that a flawed scenario if an attacker
>>got to it before you signed it?
>
>
> News Flash: Perfect Security Impossible, details at 11.
>
> :-)
>
> Seriously. The signers confirm the checksums with the release manager
> by phone or other private, difficult-to-compromise channels. Only
> then do we sign the thing.

Now see, that wasn't mentioned. Adjust slightly to the right, and the
picture comes into focus!

> If Ben Reser works for the NSA, then we're all in trouble, but then
> again, how can you be sure your compiler isn't compromised anyway?

"Woah... Time to switch to decaf, April!"

I wasn't trying to start a big security stink, I just wanted to make
sense out of the snippets of information I was seeing.

(Later I'll ask about these "i10n" emails that seem to be posted to the
list every day.)

-- 
Andrew Thompson
http://aktzero.com/
Interested in a hosted SVN repository? Email me, let's talk...
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Received on Fri Apr 22 20:23:14 2005

This is an archived mail posted to the Subversion Dev mailing list.