News for hackers. Stuff that matters.

A comment on Why the Linux kernel is hardly at risk. Parent comment

Re:Why the Linux kernel is hardly at risk by recoiledsnake on Thursday September 01, 2011 @12:44PM (#2950708)
"can be' is different from 'is'.

Since the attackers had root, what if they served up rootkitted kernels 1% of the time someone downloaded a tar ball?

[ Parent | on HN ]
Re:Why the Linux kernel is hardly at risk by bonzoesc on Thursday September 01, 2011 @03:04PM (#2951305)
The downloaders will have to be aware of the "no warranty" clause of the license Linux uses, and take responsibility for the software they bring into their environment. The kernel developers provide instructions[1] on how to cryptographically verify the authenticity of a downloaded kernel, including building a PGP "trust path" to their key.

1: http://kernel.org/signature.html

[ Parent | on HN ]
Re:Why the Linux kernel is hardly at risk by recoiledsnake on Thursday September 01, 2011 @04:18PM (#2951581)
The signatures themselves are hosted on kernel.org...
[ Parent | on HN ]
Re:Why the Linux kernel is hardly at risk by bonzoesc on Thursday September 01, 2011 @10:50PM (#2952706)
So? An attacker's not going to have the private key they were created with, and probably won't have a private key that you have an existing trust relationship to.
[ Parent | on HN ]