Re: CERT Advisory CA-2002-28 Trojan Horse Sendmail Distribution
"S. Bougerolle" <[email protected]>
| Newsgroups | gmane.linux.lfs.security |
|---|---|
| Message-ID | <1034386131.453.3.camel@cheetah> |
On Fri, 2002-10-11 at 16:15, Ian Molton wrote: > Um. If you think people are going to check the 80,000,000 packages in > gnome against md5sums and signings, you have GOT to be kidding... I would check GPG keys if they made them available (already check md5sums routinely). It's easy to do; I scripted the whole process long ago (check signature, copy file from /pub/incoming to /pub/source if valid, dump .asc file after). All that's missing is a convenient list of signatures in the same place as the download files, which GNOME should easily be able to do since 80% of their stuff comes from the same site. -- Steve Bougerolle Creek & Cowley Consulting http://www.creek-and-cowley.com -- Unsubscribe: send email to [email protected] and put 'unsubscribe lfs-security' in the subject header of the message