5 ms·

Ahhh, but what system can you trust to burn the linux boot CD on?

al1x 13y ago
Not to mention by the time you burned it it would be well out of date (security patches). If you're going to go that route you'd be better off buying a USB stick with a write-lock (Kanguru sells some).
- lifeguard 13y ago
  The usual move is to argue but I have seen un-patched Windows servers rooted in under 30 min on the public Internet. I made several recommendations to modify their SOP...
- akama 13y ago
  Kanguru has some really nice thumb drives. I own two and would recommend them to anyone. Keep in mind, you can also store private keys on them.
  - jlgaddis 13y ago
    > you can also store private keys on them As regular files (e.g. `cp ~/.gnupg/secring.gpg /media/kanguru/`) or can you somehow import them such as with a smart card? I carry multiple devices at the moment but it would be nice to consolidate.
    - akama 13y ago
      Only as regular files, but with the write lock you can be sure that they don't get deleted.
Wingman4l7 13y ago
Are you saying this software can inject malicious code into a disk image and/or falsify the integrity report if you look at the md5 checksum of said image?
- lifeguard 13y ago
  No. But it is also hard to trust a frozen OS. How often should one refresh the ISO?
  - AJ007 13y ago
    Even if your OS is out of date: 1 - Malware should be purged on shut down 2 - Only specific sites are accessed, e.g. banking domains, minimizing the risk of picking something up through e-mail or careless browsing. 3 - Obviously you shouldn't be running a server. 4 - You should still practice safe browsing, being aware of packet injection via public WiFi. If you are being specifically targeted, that is another issue.
- Asterick6 13y ago
  Also, you shouldn't even be using md5 anyways. It's essentially broken and has serious vulnerabilities. Use sha2 or sha3.
  - Wingman4l7 13y ago
    That's what I get for being specific. >.< My point was that it's unlikely that you're dealing with malware so sophisticated that it can successfully corrupt any given OS disk image and/or fake-out a checksum verification on same -- and if it can, you're probably screwed anyway.
    - jlgaddis 13y ago
      > That's what I get for being specific. That's one little thing about HN -- most people are so literal, completely missing the point. I'm sure that it's not (yet) possible to do that, although that would be a huge breakthrough. Imagine malware that could detect what (OS) is on the ISO image and inject itself into the files inside the ISO stealthily... all at run-time when you click the "burn this ISO to this CD" button. Yeah, we'd just be screwed at that point.
dinkumthinkum 13y ago
Yeah but if you go this far, how could you ever trust the bank's security?

al1x 13y ago

Not to mention by the time you burned it it would be well out of date (security patches). If you're going to go that route you'd be better off buying a USB stick with a write-lock (Kanguru sells some).

lifeguard 13y ago
The usual move is to argue but I have seen un-patched Windows servers rooted in under 30 min on the public Internet. I made several recommendations to modify their SOP...
akama 13y ago
Kanguru has some really nice thumb drives. I own two and would recommend them to anyone. Keep in mind, you can also store private keys on them.
- jlgaddis 13y ago
  > you can also store private keys on them As regular files (e.g. `cp ~/.gnupg/secring.gpg /media/kanguru/`) or can you somehow import them such as with a smart card? I carry multiple devices at the moment but it would be nice to consolidate.
  - akama 13y ago
    Only as regular files, but with the write lock you can be sure that they don't get deleted.

Wingman4l7 13y ago

Are you saying this software can inject malicious code into a disk image and/or falsify the integrity report if you look at the md5 checksum of said image?

lifeguard 13y ago
No. But it is also hard to trust a frozen OS. How often should one refresh the ISO?
- AJ007 13y ago
  Even if your OS is out of date: 1 - Malware should be purged on shut down 2 - Only specific sites are accessed, e.g. banking domains, minimizing the risk of picking something up through e-mail or careless browsing. 3 - Obviously you shouldn't be running a server. 4 - You should still practice safe browsing, being aware of packet injection via public WiFi. If you are being specifically targeted, that is another issue.
Asterick6 13y ago
Also, you shouldn't even be using md5 anyways. It's essentially broken and has serious vulnerabilities. Use sha2 or sha3.
- Wingman4l7 13y ago
  That's what I get for being specific. >.< My point was that it's unlikely that you're dealing with malware so sophisticated that it can successfully corrupt any given OS disk image and/or fake-out a checksum verification on same -- and if it can, you're probably screwed anyway.
  - jlgaddis 13y ago
    > That's what I get for being specific. That's one little thing about HN -- most people are so literal, completely missing the point. I'm sure that it's not (yet) possible to do that, although that would be a huge breakthrough. Imagine malware that could detect what (OS) is on the ISO image and inject itself into the files inside the ISO stealthily... all at run-time when you click the "burn this ISO to this CD" button. Yeah, we'd just be screwed at that point.

dinkumthinkum 13y ago

Yeah but if you go this far, how could you ever trust the bank's security?