Jan Danielsson writes:
>- If you don't know if:
> o the server storage can be trusted
> o you can fully trust the link
> o you can trust your local storage up until the point at which you
> install the package
> .. then you need the binary package to be signed.
If you
Johnny Billquist writes:
> On 2020-01-31 15:02, Greg Troxel wrote:
>> The other thing https gives you is hiding the names of the packages you
>> download from passive eavesdroppers on the network bewteen your computer
>> and the TNF server. One such possible eavesdropper is your ISP. This
>>
On 2020-01-31 20:36, Manuel Bouyer wrote:
[---]
>>*Assuming you can trust the build environment (which includes the
>> signing process)*, and assuming that you can trust the underlying crypto:
>>
>>- HTTPS protects the connection between you and the server (assuming
>> server
On 2020-01-31 15:02, Greg Troxel wrote:
The other thing https gives you is hiding the names of the packages you
download from passive eavesdroppers on the network bewteen your computer
and the TNF server. One such possible eavesdropper is your ISP. This
is part of the "https everyhwere" push;
On Fri, Jan 31, 2020 at 07:21:40PM +0100, Jan Danielsson wrote:
> On 2020-01-31 08:49, yarl-bau...@mailoo.org wrote:
> > Please Maya and Mr Billquist, can you be more specific about how it is
> > insecure?
>
>There are different domains to consider.
>
>*Assuming you can trust the build
On 2020-01-31 08:49, yarl-bau...@mailoo.org wrote:
> Please Maya and Mr Billquist, can you be more specific about how it is
> insecure?
There are different domains to consider.
*Assuming you can trust the build environment (which includes the
signing process)*, and assuming that you can
Ottavio Caruso writes:
> I have interpreted "binary packages safety" as something intrinsic to
> potential vulnerability of the 3rd party software itself, as opposed
> to package integrity checking with digital signatures, checksums, etc,
> at least related to questions 1 and 3.
In my view, the
Johnny Billquist writes:
> (Which is why I objected to the implication that https is important,
> and somehow adds some security here in the first place.)
I think you are incorrect to dismiss https. In a world without signed
packages, the flow of built binary packages from an official build
On 31/01/2020 12:05, Leonardo Taccari wrote:
Ottavio Caruso writes:
[...]
I believe there's an internal pkgsrc security mailing list to which
users have no access (I could be wrong), so I don't really know how this
auditing really works.
One can always "pkg_admin fetch-pkg-vulnerabilities &&
Ottavio Caruso writes:
> [...]
> I believe there's an internal pkgsrc security mailing list to which
> users have no access (I could be wrong), so I don't really know how this
> auditing really works.
>
> One can always "pkg_admin fetch-pkg-vulnerabilities && pkg_admin audit".
> [...]
Or putting it another way...
Martin did an excellent summary of potential risks.
You seem to be all focused on point 5 of that list, which is, I think
the least likely to be a problem or a risk. That someone would tamper
with the data en route to you is the trickiest, and least likely to
On 2020-01-31 12:39, Johnny Billquist wrote:
On 2020-01-31 12:37, Manuel Bouyer wrote:
On Fri, Jan 31, 2020 at 12:32:06PM +0100, Johnny Billquist wrote:
Of course you can. But then you need to have a whole list of trusted
public
keys that needs to be managed, which again leads to the question
On 2020-01-31 12:37, Manuel Bouyer wrote:
On Fri, Jan 31, 2020 at 12:32:06PM +0100, Johnny Billquist wrote:
Of course you can. But then you need to have a whole list of trusted public
keys that needs to be managed, which again leads to the question of which
keys are now the acceptable ones. And
On Fri, Jan 31, 2020 at 12:32:06PM +0100, Johnny Billquist wrote:
> Of course you can. But then you need to have a whole list of trusted public
> keys that needs to be managed, which again leads to the question of which
> keys are now the acceptable ones. And how to you trust new builders? Can
>
On 2020-01-31 12:32, Johnny Billquist wrote:
On 2020-01-31 12:07, Manuel Bouyer wrote:
On Fri, Jan 31, 2020 at 11:39:32AM +0100, Johnny Billquist wrote:
On 2020-01-31 11:34, Manuel Bouyer wrote:
On Fri, Jan 31, 2020 at 11:08:05AM +0100, Johnny Billquist wrote:
On 2020-01-31 10:25,
On 2020-01-31 12:07, Manuel Bouyer wrote:
On Fri, Jan 31, 2020 at 11:39:32AM +0100, Johnny Billquist wrote:
On 2020-01-31 11:34, Manuel Bouyer wrote:
On Fri, Jan 31, 2020 at 11:08:05AM +0100, Johnny Billquist wrote:
On 2020-01-31 10:25, yarl-bau...@mailoo.org wrote:
That's exactly the answer
On 2020-01-31 11:34, Manuel Bouyer wrote:
On Fri, Jan 31, 2020 at 11:08:05AM +0100, Johnny Billquist wrote:
On 2020-01-31 10:25, yarl-bau...@mailoo.org wrote:
That's exactly the answer I was waiting and hoping for. Thank you.
I'll follow tech-pkg from now on. Packages must be signed.
And
On Fri, Jan 31, 2020 at 11:39:32AM +0100, Johnny Billquist wrote:
> On 2020-01-31 11:34, Manuel Bouyer wrote:
> > On Fri, Jan 31, 2020 at 11:08:05AM +0100, Johnny Billquist wrote:
> > > On 2020-01-31 10:25, yarl-bau...@mailoo.org wrote:
> > > > That's exactly the answer I was waiting and hoping
On Fri, Jan 31, 2020 at 11:08:05AM +0100, Johnny Billquist wrote:
> On 2020-01-31 10:25, yarl-bau...@mailoo.org wrote:
> > That's exactly the answer I was waiting and hoping for. Thank you.
> >
> > I'll follow tech-pkg from now on. Packages must be signed.
>
> And with that signature, you know
On 2020-01-31 10:25, yarl-bau...@mailoo.org wrote:
That's exactly the answer I was waiting and hoping for. Thank you.
I'll follow tech-pkg from now on. Packages must be signed.
And with that signature, you know that what you got from the server was
not tampered with during transport to you,
That's exactly the answer I was waiting and hoping for. Thank you.
I'll follow tech-pkg from now on. Packages must be signed.
De : Martin Husemann
À : Ottavio Caruso
Sujet : Re: pkgsrc binary packages security with pkgin
Date : 31/01/2020 09:51:53 Europe/Paris
Copie à :
De : yarl-bau...@mailoo.org
À : Ottavio Caruso
Sujet : Re: pkgsrc binary packages security with pkgin
Date : 31/01/2020 10:15:00 Europe/Paris
De : Ottavio Caruso
À : netbsd-users@netbsd.org
Sujet : Re: pkgsrc binary packages security with pkgin
Date : 31/01/2020 09:26:06 Europe/Paris
One
Let me (as someone not heavily involved into pkgsrc and binary pkg building)
try to unriddle a few bits that I think get easily confused in this context.
When it comes to 3rd party packages, you have to trust:
(1) the original source of the package ("upstream") and its release policies.
On 31/01/2020 07:49, yarl-bau...@mailoo.org wrote:
Please Maya and Mr Billquist, can you be more specific about how it is insecure?
To all: Is someone working on it and what is ongoing to improve this?
I feel this thread belongs to pkgsrc-users@ or even better tech-pkg@ and
I'm not the OP,
24 matches
Mail list logo
