From owner-freebsd-arch Wed Mar 14 12:23:59 2001 Delivered-To: freebsd-arch@freebsd.org Received: from ns.yogotech.com (ns.yogotech.com [206.127.123.66]) by hub.freebsd.org (Postfix) with ESMTP id 81CC337B718; Wed, 14 Mar 2001 12:23:56 -0800 (PST) (envelope-from nate@yogotech.com) Received: from nomad.yogotech.com (nomad.yogotech.com [206.127.123.131]) by ns.yogotech.com (8.9.3/8.9.3) with ESMTP id NAA18022; Wed, 14 Mar 2001 13:23:55 -0700 (MST) (envelope-from nate@nomad.yogotech.com) Received: (from nate@localhost) by nomad.yogotech.com (8.8.8/8.8.8) id NAA27556; Wed, 14 Mar 2001 13:23:54 -0700 (MST) (envelope-from nate) From: Nate Williams MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <15023.54105.813938.948558@nomad.yogotech.com> Date: Wed, 14 Mar 2001 13:23:53 -0700 (MST) To: Adrian Chadd Cc: Nate Williams , freebsd-arch@freebsd.org Subject: Re: [PATCH] add a SITE MD5 command to ftpd In-Reply-To: <20010314212300.A2747@roaming.cacheboy.net> References: <20010314105918.A5204@roaming.cacheboy.net> <35525.984597779@critter> <20010314210758.A2405@roaming.cacheboy.net> <15023.53743.215996.538067@nomad.yogotech.com> <20010314212300.A2747@roaming.cacheboy.net> X-Mailer: VM 6.75 under 21.1 (patch 12) "Channel Islands" XEmacs Lucid Reply-To: nate@yogotech.com (Nate Williams) Sender: owner-freebsd-arch@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG > > I think everyone's is forgetting the 'real' reason for SITE-MD5. It's > > existance is not one of 'trust', but the reason to do this is because it > > allows the ports checker (and mirrors) to determine if a file has > > changed. Not whether or not it's trustable, not whether or not someone > > has hacked the server, but whether it has changed or not. > > I agree. the reasoning for me mentioning trust here is that it was the > basis for the entire irc discussion earlier on this (UTC+1) morning > as to why it was bad. > > Some people would say "use rsync!" :-) Except that also misses the point. If you can spoof MD5, you can spoof rsync just as easily. SITE-MD5 is an 'advisory' feature, and not a security feature. Nate To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-arch" in the body of the message