Re: how to use .asc file

jhuniepi wrote:
> thanks anyway.. i just wonder where are those .asc use if there's
> already a md5 file.

MD5 only helps to verify that the package wasn't corrupted (and it's
becoming increasingly inadequate for doing that as well: MD5 collisions
are not hard to compute, and even SHA-1 isn't holding up so well).  The
.asc is a digital signature by the packager or author and helps to
verify the authenticity of the package.  Those are two quite different
things.  If I cracked the server where you downloaded your ISO, I could
conceivably modify the ISO to do something evil and recalculate the MD5
checksum.  You, innocent downloader, would get the doctored package,
check it with MD5 and assume that it's ok, and are another victim...
However, the package author had nothing to do with the malicious code,
which is no longer authentic.  If you had taken the time to check the
GPG signature in the .asc file, that would give you a much stronger
assurance that it came from the author, as the only way that I could
forge that signature was if I possessed the package author's private key
(who should be guarding that jealously).

It takes work, but you'll be much safer if you're careful with such
things, especially for security-crucial packages.

-- 
By their own reckless arrogance they perished: childish fools,
They ate the Oxen of the Sun, and lost their hope of Home.
http://stormwyrm.blogspot.com/
_________________________________________________________
Philippine Linux Users' Group (PLUG) Newbie Mailing List
[email protected] (#PLUG @ irc.free.net.ph)
Read the Guidelines: http://linux.org.ph/lists
Searchable Archives: http://archives.free.net.ph