| |||||||||||||
|
| |||||||||||||
may not be as bad as it appearsmay not be as bad as it appearsPosted Aug 19, 2004 14:46 UTC (Thu) by beejaybee (guest, #1581)In reply to: may not be as bad as it appears by AnswerGuy Parent article: Crypto researchers abuzz over flaws (News.com)
Better still, for open source software, distribute checksums for object code (as compiled by a specific compiler on a specific hardware platform, which may not be the same as the platform the user of distributed source code intends to compile for, nor the same version of the compiler the user intends to use in a production environment) _in addition to_ checksums for the source code.
The point here is that even when it becomes economic to construct a fraudulent source file with a specific checksum, having the checksum of the object matching as well is at least several, possibly many, orders of magnitude more difficult. Downloading the extra checksums is a very marginal cost; whilst, if a very common compiler / hardware platform is chosen, finding a suitable system to run the integrity check on should not be too difficult.
So here's a security plus for OSS. Closed source (binary distribution) software products simply can't compete.
(Log in to post comments)
|
|
||||||||||||