oss-sec mailing list archives
Re: upstream source code authenticity checking
From: Alistair Crooks <agc () pkgsrc org>
Date: Fri, 26 Apr 2013 07:57:05 +0200
On Thu, Apr 25, 2013 at 01:30:23AM -0600, Kurt Seifried wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 04/24/2013 11:55 PM, Alistair Crooks wrote:I'm not sure what using PGP gains us? Regards, AlistairSo some possible outcomes are: 1) They do PGP/GPG and don't get compromised. Long term outcome: we come out way ahead. 2) They do PGP/GPG and do get compromised. Long term outcome: we trust bad things and lose, hopefully this gets spotted quickly and dealt with.
Sure. I actually agree with you. But I'd also like it if we could bear in mind that, with PGP, trust is earned, trust signatures are snapshots in time, and trust levels are private, best guessses by people. All people can see from a key listing is who trusted them and when, not how much, or whether the trust was warranted.
At a minimum this raises the bar for attackers when trying to insert a fake release/whatever. The real problem however is the cost of doing this. Key creation/storage/management/backup/etc is all non trivial and not free. Is the cost of this worth it? I think if we are going to push this we need to come up with a pretty good set of guidelines that are easy to follow and implement. Things like creation of keys, usage, storage, how to handle key roll overs, lost keys, etc. Maybe even have a trusted party signs packages sent to them, confirms the package with the project through some other trusted channel like secure email or because they know the guy in real life/etc.
I do like this idea, although think there should be more than one "trusted" party. But the tools we have don't do that kind of third-party verification; it would be good to get that in there. Regards, Alistair
Current thread:
- Re: upstream source code authenticity checking, (continued)
- Re: upstream source code authenticity checking Allan McRae (Apr 21)
- Re: upstream source code authenticity checking Alistair Crooks (Apr 21)
- Re: upstream source code authenticity checking Allan McRae (Apr 21)
- Re: upstream source code authenticity checking Alistair Crooks (Apr 21)
- Re: upstream source code authenticity checking Stuart Henderson (Apr 22)
- Re: upstream source code authenticity checking Allan McRae (Apr 21)
- Re: upstream source code authenticity checking Eric H. Christensen (Apr 24)
- Re: upstream source code authenticity checking Alistair Crooks (Apr 24)
- Re: upstream source code authenticity checking Allan McRae (Apr 24)
- Re: upstream source code authenticity checking Kurt Seifried (Apr 25)
- Re: upstream source code authenticity checking Daniel Kahn Gillmor (Apr 25)
- Re: upstream source code authenticity checking Alistair Crooks (Apr 25)
- Re: upstream source code authenticity checking Kurt Seifried (Apr 25)
- Re: upstream source code authenticity checking Dag-Erling Smørgrav (Apr 26)
- Re: upstream source code authenticity checking Kurt Seifried (Apr 26)
- Re: upstream source code authenticity checking Dag-Erling Smørgrav (Apr 26)
- Re: upstream source code authenticity checking Alistair Crooks (Apr 24)
- Re: upstream source code authenticity checking Alistair Crooks (Apr 26)
- Re: upstream source code authenticity checking Kurt Seifried (Apr 26)
- Re: upstream source code authenticity checking Eric H. Christensen (Apr 29)
- Re: upstream source code authenticity checking Daniel Kahn Gillmor (Apr 30)
- Re: upstream source code authenticity checking Robbie MacKay (May 01)
- Re: upstream source code authenticity checking Alistair Crooks (May 02)