X-Spam-Check-By: sourceware.org
Date: Mon, 16 Jul 2007 13:21:37 -0400 (EDT)
From: William Sutton <william AT trilug DOT org>
To: Louis Kruger <lpkruger AT cs DOT wisc DOT edu>
Cc: cygwin AT cygwin DOT com
Subject: Re: hacked package on server
In-Reply-To: <469B9A27.3090406@cs.wisc.edu>
Message-ID: <Pine.LNX.4.58.0707161245430.3644@dargo.trilug.org>
References: <469B9A27 DOT 3090406 AT cs DOT wisc DOT edu>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-IsSubscribed: yes
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Precedence: bulk
List-Id: <cygwin.cygwin.com>
List-Unsubscribe: <mailto:cygwin-unsubscribe-archive-cygwin=delorie DOT com AT cygwin DOT com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com

I remember an extensive discussion about the purpose MD5 sums serve for 
the cygwin installer[1] some time ago.

My understanding (synopsis) of the thread (before I gave up reading it in 
disgust somewhere around Christopher Faylor's suggestion that the subject 
be dropped :} ) was that md5sum is only used to indicate that a particular 
package had been completely downloaded (someone correct me if I 
misunderstood, please).  If that is the case, then it seems to me to be a 
bit quick to declare a server or package compromised based on a mismatch 
of md5 sums.

I do think that instead of simply aborting the install with a message that 
the server was compromised (was it?  or is something else going on?), that 
a more useful option would be to allow the user to select a different 
mirror and continue the process.

-- 
William Sutton

[1] http://cygwin.com/ml/cygwin/2007-05/threads.html#00314


On Mon, 16 Jul 2007, Louis Kruger wrote:

> >
> > On Mon, Jul 16, 2007 at 10:30:52AM -0500, Louis Kruger wrote:
> > > I also have a complaint:  the dialog that notifies the user of the failed 
> > > MD5 is not well designed.  The dialog asks "Do you want to skip the 
> > > package?" and has a yes and no button.  I read it quickly and pressed no 
> > > before thinking about it, the package went ahead and tried to install.  I 
> > > think there should be a little more effort to restrain the user from 
> > > performing a dangerous action such as installing a package with a wrong MD5.
> >
> > Good point.  The message should probably be
> >
> > Do you want to not skip the package (No/Yes)?
> >
> > cgf
> 
> I realize you are joking, but the wording of the message is beside the 
> point.  For an ordinary end-user, installing a file with a wrong MD5 is 
> the wrong (and dangerous) thing to do in just about any case I can think 
> of.  Therefore it should not be equally easy to select either option.
> 
> My opinion is that the setup program should abort immediately on 
> detecting a wrong MD5 with a message that the server may have been 
> compromised.  If there is a special case where someone may actually want 
> this, it should be something non-obvious, like a -allow-wrong-md5 flag 
> to the setup program.
> 
> thanks,
> Louis
> 
> --
> Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
> Problem reports:       http://cygwin.com/problems.html
> Documentation:         http://cygwin.com/docs.html
> FAQ:                   http://cygwin.com/faq/
> 
> 
> 

--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/