Re: CERT Advisory CA-2002-28 Trojan Horse Sendmail Distribution

On Fri, 11 Oct 2002, Ian Molton wrote:

> On Fri, 11 Oct 2002 03:33:09 +0000 (UTC)
> [email protected] (Paul Roberts) wrote:
>
> >
> > The annoying thing is that the biggest group of people who could do
> > something about this sort of thing (namely, the Gnome developers,
>
> Um. If you think people are going to check the 80,000,000 packages in
> gnome against md5sums and signings, you have GOT to be kidding...

Actually, a _large_ numbe of people building Gnome2 themselves seems to
actually be people using prepared scripts for the purpose, like CVSGnome
(which can do tarballs), GarNome, and JHBuild.  These scripts (and my own
custom stuff) already check the md5sums when available.  It would be
trivial to get them to check gpg signatures as well (mine are ready to
right now, but I'm still testing the feature with my test data).

-- 
Unsubscribe: send email to [email protected]
and put 'unsubscribe lfs-security' in the subject header of the message