Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Or just use https with certificate check.

One could argue that signed packages are still harder to check because publicly facing web servers are easier to hack, but you need to get the signature somewhere which is usually included in you distribution you downloaded through an insecure http or ftp connection.



That doesn't protect you from truncation attacks: almost no server out there sends a close_notify before closing the TLS connection, so few tools will throw an error when you receive an incomplete file.

It may be hard to exploit, but executing a script before you have completely downloaded it is simply a really bad idea.


Yes you download the signatures, but you need to trust the key which created the signatures. Distributions come with that key pre-trusted.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: