Re: Preventing government subversion in Debian, verification of binary package uploads

2013-08-25 Thread The Wanderer
On 08/24/2013 07:55 PM, Robert Holtzm wrote: On Sat, Aug 24, 2013 at 11:45:54PM +0200, Thomas Hood wrote: Here I assume that U.S. law is not so draconian that it can require someone who has contributed to Debian (and who is therefore trusted) to continue doing so. Don't be too sure. The

Re: Preventing government subversion in Debian, verification of binary package uploads

2013-08-25 Thread Robert Holtzm
On Sun, Aug 25, 2013 at 08:01:37AM -0400, The Wanderer wrote: On 08/24/2013 07:55 PM, Robert Holtzm wrote: On Sat, Aug 24, 2013 at 11:45:54PM +0200, Thomas Hood wrote: Here I assume that U.S. law is not so draconian that it can require someone who has contributed to Debian (and who is

Preventing government subversion in Debian, verification of binary package uploads

2013-08-24 Thread Erich Schubert
Hello all, Prism, NSA, Guardian etc. - I assume all of you have been following these reports, and otherwise you definitely should start reading the news. One thing that apparently has been happening a lot these days are secret court orders in the U.S. For example Google apparently was forced to

Re: Preventing government subversion in Debian, verification of binary package uploads

2013-08-24 Thread Wookey
+++ Erich Schubert [2013-08-24 14:51 +0200]: What I'd like to see is that for all packages (at least for all security relevant packages, including kernel, SSH, GPG, OpenSSL) every package is compiled multiple times, and checksums to verify that none of the build systems were compromised.

Re: Preventing government subversion in Debian, verification of binary package uploads

2013-08-24 Thread Ben Hutchings
On Sat, 2013-08-24 at 14:51 +0200, Erich Schubert wrote: Hello all, Prism, NSA, Guardian etc. - I assume all of you have been following these reports, and otherwise you definitely should start reading the news. One thing that apparently has been happening a lot these days are secret court

Re: Preventing government subversion in Debian, verification of binary package uploads

2013-08-24 Thread Thomas Hood
We will be guided by the needs of our users and the free software community. We will place their interests first in our priorities. If a Debian contributor were faced with a demand to do something that undermines the privacy or other interests of Debian users then I would hope and expect that the

Re: Preventing government subversion in Debian, verification of binary package uploads

2013-08-24 Thread Russ Allbery
Thomas Hood jdth...@gmail.com writes: If a Debian contributor were faced with a demand to do something that undermines the privacy or other interests of Debian users then I would hope and expect that the contributor would choose instead to cease being a contributor. Were he not to do so then

Re: Preventing government subversion in Debian, verification of binary package uploads

2013-08-24 Thread Philip Ashmore
On 24/08/13 22:58, Russ Allbery wrote: Thomas Hood jdth...@gmail.com writes: If a Debian contributor were faced with a demand to do something that undermines the privacy or other interests of Debian users then I would hope and expect that the contributor would choose instead to cease being

Re: Preventing government subversion in Debian, verification of binary package uploads

2013-08-24 Thread Robert Holtzm
On Sat, Aug 24, 2013 at 11:45:54PM +0200, Thomas Hood wrote: ...snip.. Here I assume that U.S. law is not so draconian that it can require someone who has contributed to Debian (and who is therefore trusted) to continue doing so. Don't be too sure. The owner of, I believe,