Re: question about the security of entries in sources.list

2002-12-04 Thread sean finney
On Wed, Dec 04, 2002 at 09:59:42AM +0800, csj wrote: > I remember reading somewhere that it would be easier to trojan > programs by simply having the requested download redirected to a > malicious server (by fooling around with the DNS stuff). for the concern i previously mentioned, you're probabl

Re: question about the security of entries in sources.list

2002-12-04 Thread csj
On Tue, 3 Dec 2002 16:30:06 -0500, sean finney wrote: [...] > while i'm not as concerned with servers like ftp.us.debian.org > being compromised (though it is a concern to the pessimist), > i'd like to make sure that the extra sources.list entries i've > put in for other things (like, say blackdo

Re: question about the security of entries in sources.list

2002-12-03 Thread sean finney
On Tue, Dec 03, 2002 at 09:56:57PM +0100, martin f krafft wrote: > signed packages or release files are being worked on. hold your toes. been watching the threads on that... > in the mean time you should bitch heavily at any operator of an > archive who has a higher version number of some softwar

Re: question about the security of entries in sources.list

2002-12-03 Thread martin f krafft
also sprach sean finney <[EMAIL PROTECTED]> [2002.11.28.0837 +0100]: > however, i started to think about the fact that if someone were to > break into metalab.unc.edu and place trojan updated versions of > debian packages in woody/main, i'd very likely end up unknowingly > upgrading to them. now i

Re: question about the security of entries in sources.list

2002-11-27 Thread nate
sean finney said: > hey all, > the principle of the matter, is there any way to limit the packages that > can be retrieved from a specific source? i too would like this info. I have been pretty turned off from 3rd party apt sources(that is, having them in sources.list all the time) for a couple y

question about the security of entries in sources.list

2002-11-27 Thread sean finney
hey all, so i've decided to give installing java a try, and put the following line in my sources.list: deb ftp://metalab.unc.edu/pub/linux/devel/lang/java/blackdown.org/debian/ woody main non-free i apt-got installed j2re1.3 and now java works without a hitch, and i didn't even have to re-open