| 1 |
2015-03-06 1:56 GMT+01:00 Rick "Zero_Chaos" Farina <zerochaos@g.o>: |
| 2 |
> |
| 3 |
> tl;dr webrsync-gpg is a built in feature of the package manager which |
| 4 |
> OPTIONALLY adds a significant amount of security against the attacks |
| 5 |
> described on your website. This is not currently the default setting, |
| 6 |
> however, it is described in many hardening guides for gentoo and widely |
| 7 |
> used among the security conscious. |
| 8 |
|
| 9 |
Without numbers backing that up this is speculation. |
| 10 |
|
| 11 |
Given the default settings (without webrsync-gpg)…: |
| 12 |
|
| 13 |
> (8) Wrong software installation. |
| 14 |
|
| 15 |
Observe the DNS requests for the rsync- or webrsync mirror. They're |
| 16 |
not encrypted and give you a nice heads-up. |
| 17 |
|
| 18 |
A. (data in transit) It's almost never HTTPS and/or without |
| 19 |
authentication, so you can easily proceed to hijacking the connection. |
| 20 |
- Primed that way (DNS) insert a new rule into a router (or |
| 21 |
nameserver) along the path or within the DC to redirect the |
| 22 |
transaction. (See "quantum insert".) |
| 23 |
|
| 24 |
B. (data at rest) Bribe or coerce the owner of the (portage tree) |
| 25 |
mirror. Manifests and ebuilds are not centrally signed and there is no |
| 26 |
authoritative "signing transparency"/record (see "certificate |
| 27 |
transparency"). |
| 28 |
|
| 29 |
-- |
| 30 |
Mark |
Archives