Re: Fwd: Fwd: question regarding verification of a debian installation iso
On Mon, Jan 03, 2011 at 12:24:16AM +0100, Naja Melan wrote:
> Arto Artinian <artinian@fastmail.fm> :
>
> > Hi Naja,
> >
>
> > I am not sure what your point is here? You don't trust pgp webs of trust,
> > nor https, nor md5 checksums of debian sources. I mean, at some point if
> > you want to use software that you didn't exclusively write and/or audit,
> > you're gonna have to implicitly trust someone. If not, what's the
> > alternative?
> >
> > Pano
> >
>
>
> My point is:
>
> If we want to seriously speak of security, than we might conceive that at an
> operating system level, amongst many other things, the issue of getting it
> from the developer to the user without it being tampered with on the way is
> quite an important point, less we ridicule ourselves. Currently this is how
> far I get on a practical level on this particular link of the security
> chain:
>
> 1. Probably the safest thing to do is buy a mac or windows cd in the shop,
> although there is (for me) no way of knowing how safe that really is.
> 2. Some linux distro's I see now do have certified https, like fedora which
> puts gpg fingerprints (SHA1) of their public keys on their certified
> website.
We have various https sites which shows you keys. But you need to
have SPI's certificate in your web browser for that, which you
probably don't have. You can find information about that at:
http://oldwww.spi-inc.org/secretary/
You can see the keys of all developers on:
https://db.debian.org/
I think you've also been pointed to:
https://ftp-master.debian.org/keys.html
Which contains the archive signing keys, but not the key to sign
the CD releases. You can use either of the above ways to verify
the content of CD.
So now you're at the point where all your trust starts from SPI's
certificate. And to import that you end back at a trusting a GPG
signature and need the trust of web to verify that.
Like I said in a previous mail, all your trust start from
somewhere. You've downloaded a bunch of certificates that
came with your web browser. Why do you trust them?
Kurt
Reply to: