Re: [OT] Re: [Full-Disclosure] Knocking Microsoft

[Cedric Blancher <blancher@xxxxxxxxxxxxxxxxxx>]

Le sam 28/02/2004 à 10:31, Martin Mačok a écrit :
> > % apt-get update && apt-get upgrade
> > % apt-get install apache-ssl
> Will it transfer the data in a secure way? (SSL?)

What's the point securing publicly available data transfer with SSL ?
The only thing that is important regarding to security for remote
software installation and/or upgrade is archive authentication and
integrity check after reception so one can avoid trojaned stuff.

> Will it verify the data after being downloaded? (PGP signature?)

Can be configured to do so. BTW, sadly, by default, only MD5 is checked.

-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html