Re: Signing Packages.gz
On Mon, 3 Apr 2000, Marcus Brinkmann wrote:
> > 1) Break root on master
> > 2) Use that to break user account on developer victum (any will do)
> > (Hint: I have already shown that torsten at least could be
> > attacked quite easially)
> > 3) Steal PGP key
> > 4) Use stolen PGP to form new glibc package with trojan, sneak into
> > archive using #1
>
> And it wouldn't be strange that random Joe is uploading a pgp package?
> And random joe or the real glibc maintainer will not speak up if this
> really happens?
Read carefully, there would be no uploading. There would be no NMU, there
woudl be No Trail. The only way this would be detected is when someone
fetched the .deb, noticed it was not Signed by Espy, checked the archives
for Signs of a NMU, found none and emailed the FTP masters to see what was
up. (ie, 99% of the people will not detect the problem)
Not very usefull is it?
Jason
Reply to: