From owner-freebsd-hackers@FreeBSD.ORG Sat Apr 12 16:27:16 2014 Return-Path: Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 39D5370D for ; Sat, 12 Apr 2014 16:27:16 +0000 (UTC) Received: from mail-lb0-x22a.google.com (mail-lb0-x22a.google.com [IPv6:2a00:1450:4010:c04::22a]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id B7ABD171E for ; Sat, 12 Apr 2014 16:27:15 +0000 (UTC) Received: by mail-lb0-f170.google.com with SMTP id s7so4527257lbd.29 for ; Sat, 12 Apr 2014 09:27:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:content-type; bh=X9YfdK5gqNS7F3rar2Fn+NnV4qWh7A99zTHCXXJ2hXI=; b=tAEr/6c2Q/rwnLXfqWRO9pHMlIGMJQoRe7Q4dwU8DL2x+fOb3j1KN6CTshBL2pEjvN j8W/DgrkBmISXQwsl0vJ0z9VHCkzmxAut1atHmvqb8I+ujF4RXbUgJ5yVBwPOtnETtgC eJvDAmYGq8LyfjxFOdGuEzSV5yD3d1/wzktRlhOUd/aasyG6Qcc9dWENYWKznUJjjWJL siNaj1+qRKZoORcfljk/VzwPsjsvo99O46UfgzdqEP6bUmsDk5ZtxOuYBAWIy4qF4UFz nfz2usWceH/mUD22ebBwK7/QU0rSBCHpTLVcU2BBRipv1u/6JqVESfaqS1fg3STbkoQv uQOQ== X-Received: by 10.152.22.37 with SMTP id a5mr22100294laf.4.1397320033521; Sat, 12 Apr 2014 09:27:13 -0700 (PDT) MIME-Version: 1.0 Sender: royce.williams@gmail.com Received: by 10.112.9.67 with HTTP; Sat, 12 Apr 2014 09:26:53 -0700 (PDT) In-Reply-To: References: <534932A8.6040801@gmx.com> From: Royce Williams Date: Sat, 12 Apr 2014 08:26:53 -0800 X-Google-Sender-Auth: mkzS57sjW8vbY05UNot-RLPDSMY Message-ID: Subject: Re: MITM attacks against portsnap and freebsd-update To: "freebsd-hackers@freebsd.org" Content-Type: text/plain; charset=ISO-8859-1 X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 12 Apr 2014 16:27:16 -0000 On Sat, Apr 12, 2014 at 8:06 AM, Tom Evans wrote: [snip] > issues to solve there. In a non license constrained world, the problem > of "how do I replicate these files from here to there" is universally > solved by rsync. Would a freebsd-update tool that required the rsync Don't portsnap and freebsd-update use cryptographic signing as well? When used to update software, signing seems like a big win over vanilla rsync. Royce