[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <5178DB8F.3010401@redhat.com>
Date: Thu, 25 Apr 2013 01:30:23 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Alistair Crooks <agc@...src.org>, Josh Bressers <bressers@...hat.com>
Subject: Re: upstream source code authenticity checking
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 04/24/2013 11:55 PM, Alistair Crooks wrote:
> I'm not sure what using PGP gains us?
>
> Regards, Alistair
So some possible outcomes are:
1) They do PGP/GPG and don't get compromised. Long term outcome: we
come out way ahead.
2) They do PGP/GPG and do get compromised. Long term outcome: we trust
bad things and lose, hopefully this gets spotted quickly and dealt with.
At a minimum this raises the bar for attackers when trying to insert a
fake release/whatever. The real problem however is the cost of doing
this. Key creation/storage/management/backup/etc is all non trivial
and not free. Is the cost of this worth it?
I think if we are going to push this we need to come up with a pretty
good set of guidelines that are easy to follow and implement. Things
like creation of keys, usage, storage, how to handle key roll overs,
lost keys, etc. Maybe even have a trusted party signs packages sent to
them, confirms the package with the project through some other trusted
channel like secure email or because they know the guy in real life/etc.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
iQIcBAEBAgAGBQJReNuPAAoJEBYNRVNeJnmTLXQQAKpQNKy4ABZcJz6H2TJQNk00
sVKFtBAhMh8reAG4eTzsoIs3LmMpca0XaOsgdWp/HeUBUUZ6L7ru0C7vtJIFy2FE
lx+os7UoR8SJpOddXkx94lgwx1dN/lzqJahWLdIUwJ569ezVqyloQkPUEDXym9Rt
qPkRCbHyrH4yQKrL0/gwKOOyVchS223pRzuvl0EkoQN3FvugBQvAIgUPUXve2S8L
+QLTmyf6KxDHR9S9E6HZwsc68XzgJgljzcZtb9TZ9Wx4njrKezx/Tm/npxq+/DGr
AfOG1/7ojXzACeuen0FBw8xjHrIX0ok6VX8bo+jIsPTYq7vaKnaZQDwDqpkq7Qwo
XR+n665+4gjlNkyc+GP2RK4HBwpyivu7gUpAlmxlum1KGLKihCYWT2zOVn5YYbNL
0hQWq0KvN5YaUrcqlIxtWnOdz1yeqNpIR1+aMfzGNFSVzMq7Z91MtOn3HEb2v4Nu
wQt4ARUU4dK+viXT8uFCuZQmSF6EvaK9Q4EXfZujuZQxB4s1bhRHxoSIySQksNPZ
A9nm3OKHXlKGaGx/iYOHX7S4m9cBTwmiqS44WzrijGDHRwMtll4Of+9algBNFXda
AUAsXtm+fgow02AfKMJuPYW7cMZLbn7qNLi6PT/E9Zsoqcs+ZEZwvv6LRR2I83uH
IcPFjgi4UUUBJOgLl0aw
=695G
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
