[Previous] [Next] [Index]
[Thread]
Re: what are realistic threats?
>But what are they signing? Are they attesting that the software
>contains no trojan horses?
Larry,
In my opinion, there is value in a package creator providing a signature
for a package, in that this (eventually) could limit the scope of the
trojan horse insertion problem to the package creator's site. (Assuming the
package creator's will eventually take the trouble to check signatures on
upstream dependency packages, and the upstream package creators will
distribute signatures also eventually)
As it is, a trojan horse could be slipped into many commonly used Internet
packages at any of the numerous ftp sites around the internet. I've seen
some ftp sites with world-writeable permissions on some Internet packages.
John