Debsums fun

2008-10-27 Thread David Baron
The newest debsums from Sid can do a daily check for md5 disagreement. Useful for security? This check flags a load of missing files which are either obsolete -- maybe I once had 'em but they are long gone -- or ... I never had 'em. Two prime examples: The former, Sun Java 1.5 stuff. Has

Re: Debsums fun

2008-10-27 Thread Sven Joachim
On 2008-10-27 08:24 +0100, David Baron wrote: The newest debsums from Sid can do a daily check for md5 disagreement. Useful for security? Not really. An attacker that can modify system files can and will also update the md5sums under /var/lib/dpkg/info. Besides, scanning each and every

Re: Debsums fun

2008-10-27 Thread Mark Allums
Sven Joachim wrote: On 2008-10-27 08:24 +0100, David Baron wrote: The newest debsums from Sid can do a daily check for md5 disagreement. Useful for security? Not really. An attacker that can modify system files can and will also update the md5sums under /var/lib/dpkg/info. Besides,

Re: Debsums fun

2008-10-27 Thread Martin Ågren
2008/10/27 Mark Allums [EMAIL PROTECTED]: On 2008-10-27 08:24 +0100, David Baron wrote: The newest debsums from Sid can do a daily check for md5 disagreement. Useful for security? [...] MD5s are not useful for security purposes any more. They are too easy to duplicate with a malicious

Re: Debsums fun

2008-10-27 Thread Mark Allums
Martin Ågren wrote: 2008/10/27 Mark Allums [EMAIL PROTECTED]: On 2008-10-27 08:24 +0100, David Baron wrote: The newest debsums from Sid can do a daily check for md5 disagreement. Useful for security? [...] MD5s are not useful for security purposes any more. They are too easy to duplicate