Date: Sun, 22 Mar 2015 08:05:27 -0400 From: Daniel Micay <danielmicay@...il.com> To: oss-security@...ts.openwall.com Subject: Re: CVE for Kali Linux On 22/03/15 07:06 AM, Florian Weimer wrote: > * Daniel Micay: > >> Is there actually a way for a Windows user to obtain it securely? > > I believe there are ideological objections to using an Authenticode > signature (same as with Tor). Tor provides their download via HTTPS from the same domain and has both HSTS preloading and HPKP. They provide a link to a GPG signature for the tarball too, but that doesn't help most users unless their distro is using it in package sources. AFAICT they plan on doing Authenticode signing, but they're doing a good job without it. The problem with these Linux distro downloads is that it's consistently done via http. That's fine for packages because package signing takes care of it. It's fine if the download is done in a way that results in verification like a torrent, but otherwise the user needs to manually verify a hash or signature and that's rarely going to happen. It's 2015 and Debian shouldn't have an HTTP download link for the ISO on their front page :P. Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.