Re:Why Package Signing is not the Holy Grail
by donaldstufft on Wednesday July 24, 2013 @03:27AM
(#6094898)
> That's why you have to trust the author and NOT the source. The author is the first creator of the code and thus the person with the most ability to sign the code.
Source of Trust, not Source of The Thing You Downloaded. The author would still sign the package, it's just how do you get from where you're at to trusting that person. The way that browsers, most (All?) Linux distributions, Microsoft etc work is by hard baking a list of trust roots. This has the effect that we have in the modern CA system where because there's a hard baked system and the trust relationship is between the "author" and the source of trust that you can't reasonably not trust say Verisign or a significant portion of the internet breaks. It's about Trust Agility not about trusting the place you downloaded the package from. It's an idea similar to http://convergence.io/.
The conclusion is especially bad.
"we'll get a solution where the end user has the relationship with the source of trust and not the package author."
That's extremely dumb, on many levels. I'll go with the possible most disturbing.
If you don't care about the author and only the source, the author just has to put a backdoor in the code. DONE.
That's why you have to trust the author and NOT the source. The author is the first creator of the code and thus the person with the most ability to sign the code.
Package signing ensure the package has not been modified (because you see, replacing SHA hashes is trivial. sha1sum file > thehashfile.txt).
Yes, you'll have to trust someone, at some point. Then you'll build more trust as time goes. That's how it is. When you get your debian package, you trust the debian devs, a bunch of them. When you trust a arch package, you trust that the devs you trusts make good trust decisions, and you trust them as well (arch uses the "web of trust").
When you trust an SSL server, you trust that your browser made the right trust decisions, and that the CA made the proper checks, and that the server owner is trustable.
When you turn on your computer you trust that intel didn't backdoor their microcode.
And so on. Trust is an infinite "issue" and securing the transport will never ensure the source is correct. Never.