From owner-freebsd-questions@FreeBSD.ORG Fri Sep 28 21:01:46 2012 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 6F9AC106566C; Fri, 28 Sep 2012 21:01:46 +0000 (UTC) (envelope-from david.i.noel@gmail.com) Received: from mail-ie0-f182.google.com (mail-ie0-f182.google.com [209.85.223.182]) by mx1.freebsd.org (Postfix) with ESMTP id 2154D8FC0C; Fri, 28 Sep 2012 21:01:45 +0000 (UTC) Received: by ieak10 with SMTP id k10so4116339iea.13 for ; Fri, 28 Sep 2012 14:01:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:cc:content-type; bh=fbpExQqe9m4NPTP9VkhlQG1Hwb44sX0+le346XngY7I=; b=q45cWXLqqi8D9O69UtcJZacyyy8QZLVuRLiY2XCHnfUj7B7Uzg3b8fsjvElu99JDU5 5cWzJbGkutwOd+I5eLMgEg/pxTsBIqjcztv+REbuC334JVVYh8be/unY+ou5jU2Yrgeq ptpJ4rxtgW6APZjQVU75SqQrNWC/5FfFTxXOwvvH7HqQxa+LwVcJpA9/EsjaGDrEx93W R2IdnbdiDZ5wPAlC5zF+ZlP3xoxhpqSCXzJAh7nsO9qjyvjd9YWMfA39v0DfifP6G4p6 B7Hm+KdBzHbdlaQ9wp1ZfMlbeZPfpoUrx9lM4LWc8c5N5rbdfwiohBgMyN2oX9v25dMA w0AQ== MIME-Version: 1.0 Received: by 10.50.57.130 with SMTP id i2mr2819024igq.56.1348866104311; Fri, 28 Sep 2012 14:01:44 -0700 (PDT) Received: by 10.64.25.130 with HTTP; Fri, 28 Sep 2012 14:01:44 -0700 (PDT) In-Reply-To: <50660AEF.2010301@FreeBSD.org> References: <20120928102822.GD2389@kontrol.kode5.net> <20120928115700.GE2389@kontrol.kode5.net> <50660AEF.2010301@FreeBSD.org> Date: Fri, 28 Sep 2012 16:01:44 -0500 Message-ID: From: David Noel To: Matthew Seaman Content-Type: text/plain; charset=ISO-8859-1 Cc: Ed Flecko , freebsd-questions@freebsd.org Subject: Re: svn checkout "head" or "stable" X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: David.I.Noel@gmail.com List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Sep 2012 21:01:46 -0000 On 9/28/12, Matthew Seaman wrote: > On 28/09/2012 20:41, Ed Flecko wrote: >> David - I'd like to, but every time I try that it prompts me for a >> password...and I don't know what password it wants??? > > That would be the password to a freebsd.org account, which isn't going > to work for most people on two counts: > > * freebsd.org uses SSH keys for authentication, not passwords. > > * even if you've got a SSH key, not being a FreeBSD committer you > probably don't have a freebsd.org account. > > For anonymous access, you can use http or svn. Given that anonymous > access is read-only, there's really not much to be gained from SSH or > other means of encrypting the connection, either for you, or for the > FreeBSD servers. It's anonymous, so you don't care about > authentication. FreeBSD sources are publicly available, so you don't > care about anyone eavesdropping on the traffic. About the only thing > you're still exposed to is a man-in-the-middle attack, where someone > could pose as a FreeBSD server and feed you a trojanned set of sources > -- but then, you'ld still be exposed in exactly the same way even using > svn+ssh. In practice, attacks of this type are very (pretty much > vanishingly) rare. If they do concern you, then use portsnap(8) / > freebsd-update(8) which has specific cryptographic protection against > such things. The portsnap and freebsd-update build systems also have > special access to the master FreeBSD repositories to minimize the > chances that they themselves could be fed trojanned sources. > > Cheers, > > Matthew > > -- > Dr Matthew J Seaman MA, D.Phil. > PGP: http://www.infracaninophile.co.uk/pgpkey MITM-based attacks--and subsequent corrupted sources--are my concern. It was my understanding that anonymous svn+ssh would prevent this assuming the host key was properly verified against http://www.freebsd.org/internal/ssh-keys.asc. Recently I've installed from an iso and then manually updated with pgp-signed security patches. It would certainly be nice to have some secure source update mechanism though.