Scot L. Harris said: [snip] > > I will have to find some time to look at this. > > > You have raised a very good question (which is actually about fedora of > all things!) > > Just how secure is the update process used by fedora? I don't think any > encryption is used for the transfer of packages, nor do I believe > certificates to validate the repository. The RPMs are signed with the Fedora GPG key. If you choose to configure your system to not check it, then you might have a problem. > So the weak points in the update process are: > > > 1. repository compromise > 2. session hijacking > 3. packet injection/spoofing All fixed by configuring up2date and/or yum to verify GPG signatures. -- William Hooper
