On Tue, Jun 15, 2004 at 05:14:46PM +0100, Paul Millar wrote:
> With network security, any activity implies at least some trust. The script
> wasn't brilliant, but pushing the functionality into winrash doesn't really
> solve the problem: we'd still need to verify the binaries somehow, or just
>
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Hi Dimi,
I think most security software gives a false sense of security, because a lot
of security problems happen at a ISO-OSI layer 9 (the nut behind the wheel :)
With network security, any activity implies at least some trust. The script
wasn't
On Fri, Jun 11, 2004 at 02:49:21PM +0100, Paul Millar wrote:
> Why remove the verification of the code's gpg signature? It seems to
> break a basic security maxim: don't trust the network.
Because the current implementation is b0rken, and it just gives us a
false sense of security. If we can't t
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Hi Chris,
Ultimately, all PKI suffers from the weakness that, unless you
distribute the public keys out-of-band (e.g. via CDROM and recorded
delivery), then you can't trust signatures.
Practically, with web browers (for example), what happens is ce
We don't have a good way of distributing and managing the gpg keys, there is
no script control over that part of winrash. If there was an automated and
secure way of keeping the trusted signatures up to date I wouldn't mind
turning it back on. It just has to be something that can be maintained
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Hi Dimi,
Why remove the verification of the code's gpg signature? It seems to
break a basic security maxim: don't trust the network.
On Thursday 10 June 2004 22:48, Dimitrie O. Paun wrote:
> ChangeLog
> Do not include irrelevant stuff in the _h
