Full Disclosure mailing list archives
secure downloading of patches (Re: Knocking Microsoft)
From: Martin Mačok <martin.macok () underground cz>
Date: Sat, 28 Feb 2004 23:33:39 +0100
On Sat, Feb 28, 2004 at 10:04:13AM -0800, bryce wrote:
Gentoo's emerge does md5 checksums checks before it unzips the tar || bzip2 ball. So a small piece of security added there.
This can only detect accidental errors during the transfer but does not protect against malicious replacement. (Just for clarification) On Sat, Feb 28, 2004 at 07:08:05PM +0100, Cedric Blancher wrote:
% apt-get update && apt-get upgrade % apt-get install apache-ssl
Will it transfer the data in a secure way? (SSL?)
What's the point securing publicly available data transfer with SSL ? The only thing that is important regarding to security for remote software installation and/or upgrade is archive authentication and integrity check after reception so one can avoid trojaned stuff.
Yes, that was my point. The main issue here is authentication and integrity -- you can achieve both with proper use of either SSL or PGP. Regarding the use of encryption, you're not just making the data secret (pointless in the case of public data). You are also securing the communication channel so no third party sees exactly what patches are you downloading and cannot trick you into downloading some junk which could attack your patch management system (huge data, decompression bombs or even exploits).
Will it verify the data after being downloaded? (PGP signature?)
Can be configured to do so. BTW, sadly, by default, only MD5 is checked.
That should be fixed IMHO. Martin Mačok _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: Knocking Microsoft, (continued)
- RE: Knocking Microsoft joe (Feb 28)
- Re: Knocking Microsoft Valdis . Kletnieks (Feb 27)
- Re: Knocking Microsoft madsaxon (Feb 27)
- Re: Knocking Microsoft William Warren (Feb 27)
- [OT] Re: Knocking Microsoft Robert Brockway (Feb 27)
- Re: [OT] Re: Knocking Microsoft Paul Schmehl (Feb 27)
- Re: [OT] Re: Knocking Microsoft martin f krafft (Feb 28)
- Re: [OT] Re: Knocking Microsoft Martin Mačok (Feb 28)
- Re: [OT] Re: Knocking Microsoft Rui Miguel Seabra (Feb 28)
- Re: [OT] Re: Knocking Microsoft bryce (Feb 28)
- secure downloading of patches (Re: Knocking Microsoft) Martin Mačok (Feb 28)
- Re: secure downloading of patches (Re: Knocking Microsoft) Cedric Blancher (Feb 29)
- Re: secure downloading of patches (Re: Knocking Microsoft) Martin Mačok (Feb 29)
- Re: secure downloading of patches (Re: Knocking Microsoft) Cedric Blancher (Feb 29)
- Re: [OT] Re: Knocking Microsoft Paul Schmehl (Feb 27)
- Re: [OT] Re: Knocking Microsoft Cedric Blancher (Feb 28)
- Re: [OT] Re: Knocking Microsoft Tim (Feb 28)
- Re: [OT] Re: Knocking Microsoft Paul Schmehl (Feb 29)
- OT: Re: Knocking Microsoft gadgeteer (Feb 27)
- Re: OT: Re: Knocking Microsoft Valdis . Kletnieks (Feb 27)
- Re: OT: Re: Knocking Microsoft gadgeteer (Feb 27)