What you're saying is totally bogus. It's like saying that because there are other ways to fall down the stairs, let's not teach one way of not falling down the stairs. That has got to be the most ridiculous kind of argument in defense of bad advice I've ever seen. If you only use root for when you really need to, then the probability that you will have problems falls down by several orders of magnitude. Most Fedora user will run software from reasonable sources, which have the humanely possible community resources to review software. up2date and yum and other meta packagers should simply refuse to install unsigned packages unless forced to. Fedora Core packages do have to be signed, anyway. Should we just do like Lindows and run everything as root? We might just as well. Rui On Wed, 2004-01-07 at 12:58, Andy Green wrote: > Couldn't agree more... but the original point is that railing against doing a > make as root is not going to solve anything when we are daily installing RPMs > as root, signed or unsigned. And as you point out, the signature is only an > assurance that at some point the package was processed by somebody who had > that private key.... it doesn't have anything to say about the untaintedness > of the sources -- or the security of the signer's machines and key. > > Unless you undertake to scour sources personally and install by compile only > - -- something most people would reasonably consider an impossible burden -- > you take on a risk by using binary packages, and its hard to see what can be > done to mitigate that, especially when attacks inside RPM scripts could be > very subtle and indirect. -- + No matter how much you do, you never do enough -- unknown + Whatever you do will be insignificant, | but it is very important that you do it -- Gandhi + So let's do it...? Please AVOID sending me WORD, EXCEL or POWERPOINT attachments. See http://www.fsf.org/philosophy/no-word-attachments.html -- + No matter how much you do, you never do enough -- unknown + Whatever you do will be insignificant, | but it is very important that you do it -- Gandhi + So let's do it...? Please AVOID sending me WORD, EXCEL or POWERPOINT attachments. See http://www.fsf.org/philosophy/no-word-attachments.html
Attachment:
signature.asc
Description: This is a digitally signed message part
