Messages in this thread | | | Subject | Re: kernel.org frontpage | From | Valdis.Kletnieks@vt ... | Date | Wed, 29 Jan 2003 13:55:22 -0500 |
| |
On Wed, 29 Jan 2003 13:36:55 EST, Chris Friesen said:
> Perhaps for the truly paranoid the signatures should be posted to this > newsgroup and digitally signed by someone trusted.
It's called the PGP web of trust. There's already some 107 signatures on the PGP key - who else would you want signing it? The point is that we've already (presumably) proved via the web-of-trust that PGP key 517d0f0e is in fact the proper key, and that for an intruder to post a valid signature of a trojaned .tar.gz would require them to *ALSO* compromise the machine that the signing is done on (hopefully a different machine than ftp.kernel.org).
Yes, an intruder could leave a forged signature with a random key easily. But to leave a forged signature with the key that's already on my keyring is a lot harder... -- Valdis Kletnieks Computer Systems Senior Engineer Virginia Tech
[unhandled content-type:application/pgp-signature] | |