Raspberry Pi Z-Wave kit exposes private key

Re:Raspberry Pi Z-Wave kit exposes private key by bodyfour on Friday February 20, 2015 @04:05AM (#9079613)

Not any worse than installing an RPM/deb (which includes an embedded preinstall script) Or the normal "./configure / make / make install" pattern which gives a malicious distributor lots of boilerplate to hide in.

If anything it's probably safer since it's explicit and more likely to be audited.

[ Parent | on HN ]

Re:Raspberry Pi Z-Wave kit exposes private key by ars on Friday February 20, 2015 @04:25AM (#9079663)

If you install deb's normally they are signed, and it does check the signature.

Perhaps the one-liner should be amended to check the hash of the file first, and only run if it matches.

[ Parent | on HN ]

Re:Raspberry Pi Z-Wave kit exposes private key by legulere on Friday February 20, 2015 @06:03AM (#9079917)

Or just use https with certificate check.

One could argue that signed packages are still harder to check because publicly facing web servers are easier to hack, but you need to get the signature somewhere which is usually included in you distribution you downloaded through an insecure http or ftp connection.

[ Parent | on HN ]

Re:Raspberry Pi Z-Wave kit exposes private key by xnyhps on Friday February 20, 2015 @07:00AM (#9080046)

That doesn't protect you from truncation attacks: almost no server out there sends a close_notify before closing the TLS connection, so few tools will throw an error when you receive an incomplete file.

It may be hard to exploit, but executing a script before you have completely downloaded it is simply a really bad idea.

[ Parent | on HN ]

Re:Raspberry Pi Z-Wave kit exposes private key by grhmc on Friday February 20, 2015 @09:47AM (#9080595)

Yes you download the signatures, but you need to trust the key which created the signatures. Distributions come with that key pre-trusted.

[ Parent | on HN ]