Re: [gentoo-security] Re: Trojan for Gentoo, part 2

[Andreas Waschbuesch]

epistula illius Dan Margolis profluit verbis:
> [...]
> Yes, this has the basic assumption that the private key is secure, but
> all secure systems make a few basic assumptions, so this is hardly
> unprecedented (we cannot thoroughly prove the security of RSA, and we
> often can't even come close for symmetric-key systems), but that
> doesn't mean that they have inherently zero value. I find that sort of
> argument to be quite flawed, because it's essentially saying, ``Well,
> nothing is provably secure, so why even have secure systems?''
> [...]

Sorry, but i completely disagree. Guidelines exist. The "weakest link" and 
"general participation" strategy base is lacking, signed ebuilds or not. 
I could open some - as ist seems - "usefull" sourceforge-project and 
inject any "additional" code on gentoo systems, while submitting a 
perfectly "legal" ebuild, signed to "heavenly" trust. Will security 
developers check the source? Will the users do it? It's just one possible 
"leak", but it's the first one. So where is the security? It's gone, 
since nobody actually can nor could foresee or calculate anything as long 
as there is no global code auditing implemented.

Good will, ideas, step by step implemented - apreciated. Maybe many 
$PROJECTS would "follow". But one fact remains: the complete process has 
to be dealt with: from source-generation over distribution to 
installation. And as long as it's not completely done, security is not 
calculable and therefore "zero". So dealing with signed ebuilds 
securitywise is like dealing with signs on the frontdoor saying "this 
house is safe".

My 2 cents ...

-- 
Andreas Waschbuesch, GAUniversity KG MA FNZ FK01
eMail: awaschb@××××.de

Said the attractive, cigar-smoking housewife to her girl-friend: "I got
started one night when George came home and found one burning in the 
ashtray."