Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: All the md5 hashes in every single update message sent to this list
From: "Thor (Hammer of God)" <thor () hammerofgod com>
Date: Sat, 16 Oct 2010 16:10:24 +0000

Because you have a separate "out-of-band" communication from the publisher containing the hashes.  Anyone hosting the 
files somewhere could have altered the patch and then generated their own MD5 hash and "signed" it themselves and 
provided that on their site.  It's just another layer of authentication.  

Best thing to do is just ignore it if you don't agree with the practice as you can't control how or why a developer 
chooses to publish patch details. 

t

-----Original Message-----
From: full-disclosure-bounces () lists grok org uk [mailto:full-disclosure-
bounces () lists grok org uk] On Behalf Of ben () b1towel com
Sent: Saturday, October 16, 2010 8:46 AM
To: Zach C.
Cc: full-disclosure () lists grok org uk
Subject: Re: [Full-disclosure] All the md5 hashes in every single update
message sent to this list

What is the advantage of having all the hashes posted to the list over doing
something like having a digitally signed text file next to the update on their
servers and occasionally publish the pubkey to the list? I feel like that would
provide the same level of confidence the package was unaltered as just
reading the hashes from the list.

They do this so that people who are manually installing or updating
software can also verify that the package they are installing is, in
fact, the exact same one that the software packager released -- this
reduces (but not
eliminates) the chance that someone malicious may have been able to
slip something into the update package unnoticed by the installer or
the packager.

On Fri, Oct 15, 2010 at 11:22 PM, B1towel <ben () b1towel com> wrote:

What is the purpose of all the patch notification emails that when a
security vulnerability is fixed the people who send out the
notification email include a 5 mile long list of md5 hashes for every
single package and all dependancies for the package that was updated?
I feel that information does not need to be in the notification that
the latest version fixed a security vulnerability, and to me it just
gets in the way of reading the occasionally useful content this list
has to offer.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/




_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault