OpenSSL.org hacked?

Re:OpenSSL.org hacked? by 0x0 on Saturday December 28, 2013 @10:02PM (#6978058)

If they can replace the front page html, they could probably also replace the source code distribution with a backdoored/trojaned tarball. Or someone else might already have done so, since who knows how long ago, using the same exploit.

[ Parent | on HN ]

Re:OpenSSL.org hacked? by userbinator on Saturday December 28, 2013 @11:10PM (#6978327)

But would they also be able to replace the public key of the authors in all the other places it appears on the Internet?

[ Parent | on HN ]

Re:OpenSSL.org hacked? by dionyziz on Sunday December 29, 2013 @12:20AM (#6978517)

That. That's why the authors PGP-sign their sources. Furthermore, some of us maintain GPG trust paths, so replacing it on every other place on the Internet would still be futile.

[ Parent | on HN ]

Re:OpenSSL.org hacked? by dmix on Sunday December 29, 2013 @02:28AM (#6978775)

There is also benefits of using decentralized distribution channels like bittorrent. So a single source can't be compromised.

[ Parent | on HN ]