[gentoo-hardened] Re: [gentoo-security] Trojan for Gentoo/GNU Linux, proof of concept

[Joshua Brindle]

As the founder of gentoo's new security project gentoo-hardened i really feel that I must say something here
I happen to disagree with Kurt's line of reasoning here, I have personally been bugging
everyone around for an ebuild signing system for months, and it's been spoken about 
for over 6 months. Many people have talked about this, the pro's and con's, and those
of us who have any security needs have pressured the people involved. 

For my hardened project to actually have an effect ebuild signing is mandatory, and the
sooner the better, before or after 1.4. 

Having said that, it's about time someone took a stand and posted proof that bad things
will happen if ebuild signing doesn't happen. This is exactly the kind of pressure
people respond to and maybe something will actually get done about it now. 

The person who posted this is well within his right, and this is how opensource
projects often are driven to 'be better'. There has been work on ebuild signing 
from several people at some point, but the few people who don't like the idea
have spent a lot of time discouraging people. This is not acceptable IMO, and
I would like to remind everyone involved that it is a very small minority that 
wants this project blocked. I believe the sentiment among the other devs
and especially users is that this _must_ go forward. 

Thank you, please don't flame on this thread anymore, everything has been 
said that needs to be said, if you feel the need to flame come to irc and talk 
to me and others in person. 




Joshua Brindle

>>> Kurt Lieber <klieber@g.o> 03/20/03 12:09PM >>>
On Thu, Mar 20, 2003 at 10:02:51AM -0800 or thereabouts, tfandango wrote:
> about it.  Here's a guy who is concerned about the
> security of the Gentoo portage system and posts a
> question in the security mailing list about it.

Asking questions and posting proof-of-concept trojans *without* first
asking questions are two different things entirely.

--kurt

--
gentoo-hardened@g.o mailing list