4 ms·

> What you are really asking is "how can I trust code written by other people". You cannot. That's not his point. The concern is that without a secure channel

by sigterm 13y ago

> What you are really asking is "how can I trust code written by other people". You cannot. That's not his point. The concern is that without a secure channel of distribution from the author, Ubuntu can be MITM'ed into packaging a tampered binary.

IgorPartola 13y ago
Ubuntu absolutely can be MITM'ed. So can you when downloading the source code. Moreover, you don't have to MITM attack Ubuntu (or rather Debian) into downloading a compromised version of the KeePass source. You could MITM attack anything the Ubuntu/Debian developers download, whether it be the source code to stuff that's going into Debian/Ubuntu as a package or something they are installing on their machines. I repeat, at some point you have to trust someone, otherwise all software and hardware is suspect. Now, the really big question to ask here is what processes do we have in place for this not to happen. Downloading stuff over HTTPS is clearly not good enough: there are many ways someone willing to compromise a distro can circumvent it (including forcing a CA to give out a rouge certificate, or simply threatening the individual software developer into accepting a malicious patch). The best I can think of is using the PGP/GPG web of trust. When Debian Maintainer Dave gets an updated version of the source for package foo from Programmer Pete, Dave can verify that Pete actually authored the code by making sure the source is properly signed with Pete's GPG key. Dave knows Pete's public key having properly exchanged keys with him in person. I think that's the best we can do. Mind you in the above we cannot guarantee that Pete does not turn to the dark side, either willingly or forced into it by a powerful adversary (NSA, drug cartels, etc.) The best we can do is that Dave is not also turned to the dark side and that Dave carefully reads and catches any security issues with the code Pete delivers to him. This is what keeps your distro safe, nothing else, so buy a maintainer a beer next time you meet one.

by sigterm 13y ago

IgorPartola 13y ago

Ubuntu absolutely can be MITM'ed. So can you when downloading the source code. Moreover, you don't have to MITM attack Ubuntu (or rather Debian) into downloading a compromised version of the KeePass source. You could MITM attack anything the Ubuntu/Debian developers download, whether it be the source code to stuff that's going into Debian/Ubuntu as a package or something they are installing on their machines. I repeat, at some point you have to trust someone, otherwise all software and hardware is suspect. Now, the really big question to ask here is what processes do we have in place for this not to happen. Downloading stuff over HTTPS is clearly not good enough: there are many ways someone willing to compromise a distro can circumvent it (including forcing a CA to give out a rouge certificate, or simply threatening the individual software developer into accepting a malicious patch). The best I can think of is using the PGP/GPG web of trust. When Debian Maintainer Dave gets an updated version of the source for package foo from Programmer Pete, Dave can verify that Pete actually authored the code by making sure the source is properly signed with Pete's GPG key. Dave knows Pete's public key having properly exchanged keys with him in person. I think that's the best we can do. Mind you in the above we cannot guarantee that Pete does not turn to the dark side, either willingly or forced into it by a powerful adversary (NSA, drug cartels, etc.) The best we can do is that Dave is not also turned to the dark side and that Dave carefully reads and catches any security issues with the code Pete delivers to him. This is what keeps your distro safe, nothing else, so buy a maintainer a beer next time you meet one.