Leonardo Rodrigues wrote:
the databases are digitally signed, and any modification, such in
a man-in-the-middle attack, would break the signature and freshclam
would refuse to run the files.
Sounds good. Can you please explain how this works in detail?
Apt places GPG keys in the system
Hello,
Le 15/03/2019 à 16:04, instaham--- via clamav-users a écrit :
Leonardo Rodrigues wrote:
the databases are digitally signed, and any modification, such in
a man-in-the-middle attack, would break the signature and freshclam
would refuse to run the files.
Sounds good. Can you please
For what it's worth, one of the tasks we're working on for 0.102 is https
support for freshclam.
It's more than just adding an "s" to the URL. The plan is to make libcurl a
hard requirement for ClamAV, which will also mean including libcurl on Windows.
Then we'll have to rewrite the
Op Vrijdag, 15-03-2019 om 16:04 schreef instaham--- via clamav-users:
> Leonardo Rodrigues wrote:
> > the databases are digitally signed, and any modification, such in
> > a man-in-the-middle attack, would break the signature and freshclam
> > would refuse to run the files.
>
> Sounds good.
Em 15/03/2019 14:39, G.W. Haywood via clamav-users escreveu:
Hi there,
On Fri, 15 Mar 2019, Franky Van Liedekerkewrote:
Certifcates cost nothing ...
CPU cycles don't.
developers time do cost their ... time, basically. How about
contributing with the code instead of blaming ? That
Hi there,
On Fri, 15 Mar 2019, Franky Van Liedekerkewrote:
Certifcates cost nothing ...
CPU cycles don't.
--
73,
Ged.
___
clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users
Help us
I had this question a while back, and this is what I was able to track down:
The files are not signed via any PKI trusted by your system, but rather by a
specific RSA key that is trusted by the code itself. If you look in
libclamav/dsig.c, there is an implementation of RSA inspired by
