Re: get the lead out of repos



David Bolt wrote:

On Tuesday 23 Mar 2010 08:38, while playing with a tin of spray paint,
Darklight painted this mural:

how well can you trust those mirrors

How well can you trust _any_ mirror? Kernel.org is listed as one of the
mirrors for openSUSE, and so Novell believes they are trustworthy.

Nothing to do with Novell, nor openSUSE. It is relative easy to become
openSUSE mirror, but the magic that provides trust is not in a package
management alone. It is package management in combination with
http://download.opensuse.org ie. http://mirrorbrain.org/ that is serving
repository metadata from single source and managing redirects.

As long as you don't use script in a first post that will force package
management software to pick repository meta information from mirror, but
leave http://download.opensuse.org as source of that information, you can
trust any mirror as much as you trust openSUSE, provided that you don't
ignore warnings about wrong checksums, signatures etc.

As soon as you use mirror as source of repository meta information you
better use trusted mirror.

Mirror operator has power to replace meta information and install on your
computer anything using the same package management that is trustworthy when
used in combination with http://download.opensuse.org .


[1] http://www.cs.arizona.edu/stork/packagemanagersecurity/
The claim that all are vulnerable is not really correct, which can be seen
in "Other Attacks":
http://www.cs.arizona.edu/stork/packagemanagersecurity/otherattacks.html

If you want to be safe use YaST :)



--
Regards Rajko,
.



Relevant Pages

  • Re: OT Health reform summit
    ... REAL problem all they have to do is look in the mirror. ... Boxers as bad as the rest. ... their main concern should be doing what's right for the country. ... Trust in me and fall as well ...
    (alt.sports.basketball.nba.la-lakers)
  • Re: OT Health reform summit
    ... REAL problem all they have to do is look in the mirror. ... that's senile as hell and he keeps getting reelected. ... Trust in me and fall as well ...
    (alt.sports.basketball.nba.la-lakers)
  • Re: OT Health reform summit
    ... Its funny how just about EVERYONE is bitching about the fed congress and senate as well as the state congress and senate, if they want to see the REAL problem all they have to do is look in the mirror. ... Hell there's one that's senile as hell and he keeps getting reelected. ... Trust in me and fall as well ...
    (alt.sports.basketball.nba.la-lakers)
  • Re: 1.12? Breaking News...
    ... Can I ask you the source if this patch? ... Not that I don't trust you, ... is first mirror for EU patches I have seen. ... "When you try to change a mans paradigm, you must keep in mind that he ...
    (alt.games.warcraft)
  • Re: OT question
    ... Would you propose that you should use the mirror also to wash ... You don't trust someone simply because you're told that you're supposed to ... conscience was uncluttered, without rules and regulations. ... And once it's hard, dry, and brittle, there's no going back. ...
    (sci.med.transcription)