Re: Old / new key flaw

2011-12-23 Thread Stefan Bodewig
On 2011-12-23, Ramon Smits wrote: > I can share some thought about this new key philosophy regarding they > anyone should be able to patch it but I think it is wrong. How can I > validate a package from untrusted sources if they have access to the > 'official' private key ? The only official bina

RE: Old / new key flaw

2011-12-23 Thread Walden H. Leverich
m<http://www.techsoftinc.com/> http://www.IRBManager.com<http://www.irbmanager.com/> Quiquid latine dictum sit altum viditur. (Whatever is said in Latin seems profound.) From: Ramon Smits [mailto:ramon.sm...@gmail.com] Sent: Friday, December 23, 2011 3:49 AM To: log4net-dev@logging.apache.org Subject

Old / new key flaw

2011-12-23 Thread Ramon Smits
What is it with this old/new key? http://logging.apache.org/log4net/download_log4net.cgi I can share some thought about this new key philosophy regarding they anyone should be able to patch it but I think it is wrong. How can I validate a package from untrusted sources if they have access to the