Date: Thu, 1 Dec 2005 17:15:30 +1100 From: Peter Jeremy <PeterJeremy@optushome.com.au> To: Alexander Leidinger <netchild@freebsd.org> Cc: freebsd-security@freebsd.org Subject: Re: Reflections on Trusting Trust Message-ID: <20051201061530.GG32006@cirb503493.alcatel.com.au> In-Reply-To: <20051130194250.255d2e18@Magellan.Leidinger.net> References: <20051127182116.GA30426@cirb503493.alcatel.com.au> <000e01c5f410$2de67820$1300110a@pooptop> <20051130144343.od5die60gsw4k0k0@netchild.homeip.net> <20051130181530.GE32006@cirb503493.alcatel.com.au> <20051130194250.255d2e18@Magellan.Leidinger.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, 2005-Nov-30 19:42:50 +0100, Alexander Leidinger wrote: > But if you get the same *wrong* data (for the PGP keys it's >relatively easy to verify) from several locations (cvsup*.FreeBSD.org + >cvsweb.freebsd.org + www.freebsd.org, don't forget to check if they >point to a reasonable amount of different IP's; Keep in mind that for most people these addresses will all go through a single ISP. You need to to check several locations via several different paths (eg home and work or maybe cross-check with a friend who uses a different ISP). > the printed handbook >and the handbook on the release CDs), then you have other things to >worry about... I agree that if Agent Smith is out to get you then you have problems. >Assuming enough resources: ATM only by downloading all and diffing >them. If they all match, you are either busted already since the >attacker controls too much, or you can say the probability is high >enough that you got a copy of the original repository. This is non-trivial because the repository is not static and CVS doesn't store transaction logs that would allow you to reproduce the repository state at a point in time. -- Peter Jeremy
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20051201061530.GG32006>