Re: [gentoo-security] Built in integrity?

[James Harlow]

On Tue, Feb 10, 2004 at 09:29:57AM +0100, shoehn@××××××××××××××××××××.info wrote:
> If portage uses an evil server both the files and the MD5 values are
> tampered, the problem is that the user considers the wrong MD5 value
> as correct. I do not generate a file that has the "official" MD5
> value, I give the user a wrong MD5 value, by establishing a bad mirror.

Presumably this is why the checksums are distributed out-of-band of the
distfiles. 

-- 
When a true genius appears in the world, you may know him by this sign, that the dunces are all in confederacy against him. - Jonathan Swift

--
gentoo-security@g.o mailing list