Linked by Jordan Spencer Cunningham on Mon 14th Jun 2010 23:58 UTC
Permalink for comment 430041
To read all comments associated with this story, please click here.
To read all comments associated with this story, please click here.
News
Linked by Thom Holwerda on 06/18/13 22:33 UTC
Linked by Anonymous on 06/18/13 22:26 UTC
Linked by Thom Holwerda on 06/18/13 22:25 UTC
Linked by Thom Holwerda on 06/18/13 17:45 UTC
Linked by Thom Holwerda on 06/18/13 17:32 UTC, submitted by poundsmack
Linked by Thom Holwerda on 06/17/13 17:58 UTC
Linked by Thom Holwerda on 06/17/13 17:52 UTC
Linked by Thom Holwerda on 06/14/13 21:03 UTC
Linked by Thom Holwerda on 06/14/13 20:46 UTC
Linked by Thom Holwerda on 06/14/13 17:32 UTC
More News »
Sponsored Links



Member since:
2007-02-17
If you examine the source code, and test the application that the source code produces, and then sign that with GPG, then later on no-one else can come along and attach something else (and something malicious) to the tarball on your server.
Had UnrealIRCd bothered to GPG sign the original Unreal3.2.8.1.tar.gz file with their repository key, then it could not have been replaced on their server or mirrors without triggering a GPG warning when anyone tried to install the trojaned version.
This is part of the way that Linux package managers actually work.
http://en.wikipedia.org/wiki/Package_management_system#Functions
Verifying digital signatures to authenticate the origin of packages.
Edited 2010-06-15 02:51 UTC