Subject: Re: Binaries for Solaris 2.3

From: [email-masked] (Mark Walker)
Date: Wed, 01 Mar 1995 13:54:13 -0700 (MST)

Russell Street writes:
>> I have found Bin+src package for Solaris 2.3 SPARC on 
>>  ftp.rus.uni-stuttgart.de but don't remember the directory :(
>
>I don't know about anyone else around here, but grabbing precompiled
>binaries and running them on your machines seems very foolish.  Even
>more so as they run as root!
>
>Be careful out there...

We do have to be careful; even when compiling from source.  It wasn't
too long ago that the wu-ftpd code contained a trojan horse that had
been placed by a {cr,h}acker.  This version was pulled and notices were
sent out, upon discovery; but many sites were (and may still be) running
that version.

At this point it would be a very good idea to install md5 and pgp if
only for use in verifying packages that use these mechanisms for
additional identification/security of the distribution media.  (We plan
to archive md5 signatures of important files just after from-scratch
installations on our systems and to verify them periodically.)

One can still ask, "What makes the authentication information any more
trustworthty than the packages we download?"  This is a pretty good
question.  I figure that one can at least easily compare the
authentication info from several sources to gain a better level of
confidence.  Beyond that, public-key encryption systems can provide
an excellent level of confidence for authentication of any data,
including software in any digital format.

With such authentication in place, even binaries would be as trustable
as the source.  I'd still insist on having source for the net-software
we I run.  My reasons have nothing to do with my opinion of the
trustworthiness of the source of the software though.

--
Mark Walker                     UNM/EECE, 7-3688, [email-masked]

                "I didn't do it."               -- Bart Simpson