Message-ID: <4BA17A9F.2000808@monai.ca>
Date: Wed, 17 Mar 2010 17:58:07 -0700
From: Steven Monai <steve+cygwin@monai.ca>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.8) Gecko/20100227 Thunderbird/3.0.3
MIME-Version: 1.0
To: cygwin@cygwin.com
Subject: Re: incomplete/corrupted setup.exe
References: <1268766945.5263.ezmlm@cygwin.com>  <Pine.LNX.4.58.1003171042591.9914@mail3.jubileegroup.co.uk> <20100317150649.GA29284@ednor.casa.cgf.cx>
In-Reply-To: <20100317150649.GA29284@ednor.casa.cgf.cx>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com

On 2010/03/17 8:06 AM, Christopher Faylor wrote:
> Since I haven't seen any guarantees that adding https would fix this
> problem I'm not convinced that this justifies the amount of work
> involved.  So, until the mailing list is flooded with people who can't
> download setup.exe because we don't have https access, I am satisfied
> with not doing anything.

That's too bad. Using SSL would nearly eliminate the risk of a MITM
delivering a bogus setup.exe in place of the real thing to some
unsuspecting user.

As an alternative to setting up SSL on cygwin.com, what about the idea
of crypto-signing (e.g. with gnupg) every release of setup.exe, and then
posting the signature alongside the binary? I know I would breathe a
little easier if I were able to positively verify the authenticity of a
given setup.exe binary.

The public key would need to be distributed via channels other than just
cygwin.com, to make it more difficult to spoof. Fortunately, there are a
number of public PGP/GPG key servers to fill that purpose.

-SM
--

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple