From owner-freebsd-ports-bugs@FreeBSD.ORG  Sun Feb 29 22:50:19 2004
Return-Path: <owner-freebsd-ports-bugs@FreeBSD.ORG>
Delivered-To: freebsd-ports-bugs@hub.freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id B3F2816A4CE
	for <freebsd-ports-bugs@hub.freebsd.org>;
	Sun, 29 Feb 2004 22:50:19 -0800 (PST)
Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 7E9B243D2D
	for <freebsd-ports-bugs@hub.freebsd.org>;
	Sun, 29 Feb 2004 22:50:19 -0800 (PST)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1])
	i216oJbv090716	for <freebsd-ports-bugs@freefall.freebsd.org>;
	Sun, 29 Feb 2004 22:50:19 -0800 (PST)
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.12.10/8.12.10/Submit) id i216oJoM090715;
	Sun, 29 Feb 2004 22:50:19 -0800 (PST)
	(envelope-from gnats)
Date: Sun, 29 Feb 2004 22:50:19 -0800 (PST)
Message-Id: <200403010650.i216oJoM090715@freefall.freebsd.org>
To: freebsd-ports-bugs@FreeBSD.org
From: tmseck-lists@netcologne.de (Thomas-Martin Seck)
Subject: Re: ports/63546: ports/security/libprelude - fetch PGP signature
X-BeenThere: freebsd-ports-bugs@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
Reply-To: Thomas-Martin Seck <tmseck-lists@netcologne.de>
List-Id: Ports bug reports <freebsd-ports-bugs.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ports-bugs>,
	<mailto:freebsd-ports-bugs-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ports-bugs>
List-Post: <mailto:freebsd-ports-bugs@freebsd.org>
List-Help: <mailto:freebsd-ports-bugs-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ports-bugs>,
	<mailto:freebsd-ports-bugs-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 01 Mar 2004 06:50:19 -0000

The following reply was made to PR ports/63546; it has been noted by GNATS.

From: tmseck-lists@netcologne.de (Thomas-Martin Seck)
To: bug-followup@freebsd.org
Cc:  
Subject: Re: ports/63546: ports/security/libprelude - fetch PGP signature
Date: 1 Mar 2004 06:49:38 -0000

 * Jason Harris <jharris@widomaker.com> [gmane.os.freebsd.devel.ports.bugs]:
 
 > On Sun, Feb 29, 2004 at 10:23:33PM +0100, Oliver Eikemeier wrote:
 > 
 >> Unfortunate, but I guess we can fix this. I hope I made my point without 
 >> offending you, but blindly downloading and verifying a PGP signature is 
 >> actually *less* secure than the md5 checksum in distinfo, and worse, it
 >> gives a false sense of security.
 
 I agree with you here.
 
 > No offense taken - your presumptions about security plague many.
 
 This has -- IMO -- nothing to do with security. It is already the
 (unwritten) maintainer's duty to verify a signed distfile and it is (or
 really should be) the committer's duty to do the same. The only purpose
 of an automated check on the user's end would just be a check whether a
 maintainer/committer was careless or part of a grand "let's trojan
 FreeBSD" conspiracy.