Re: future Redhat security-patches updating policy ?

1999-10-04 Thread JF Martinez
> > > b) how did you do this without a GPL violation? Since you're restricting > >redistribution (not your own fault, obviously), and since you've > > They aren't restricting it - the US government are. You can redistribute > it as you see fit. You can go to court and fight first amendment a

Re: future Redhat security-patches updating policy ?

1999-10-04 Thread Alan Cox
> b) how did you do this without a GPL violation? Since you're restricting >redistribution (not your own fault, obviously), and since you've They aren't restricting it - the US government are. You can redistribute it as you see fit. You can go to court and fight first amendment and the like.

Re: future Redhat security-patches updating policy ?

1999-10-04 Thread Edward S. Marshall
On Sun, 3 Oct 1999, Matt Wilson wrote: > So now, for the good news. Beginning with Red Hat Linux 6.1, all our > packages are GPG signed. Red Hat Linux purchased in the US includes > GPG, mutt with GPG hooks, a GUI frontend to GPG (called gpgp), and > the 128 bit crypto version of Netscape Commun

Re: future Redhat security-patches updating policy ?

1999-10-04 Thread Bill Nottingham
John Summerfield ([EMAIL PROTECTED]) said: > > So now, for the good news. Beginning with Red Hat Linux 6.1, all our > > packages are GPG signed. Red Hat Linux purchased in the US includes > > GPG, mutt with GPG hooks, a GUI frontend to GPG (called gpgp), and > > the 128 bit crypto version of Ne

Re: future Redhat security-patches updating policy ?

1999-10-04 Thread John Summerfield
> On Sun, Oct 03, 1999 at 02:26:20PM -0700, H. Peter Anvin wrote: > > > > It can -- but it isn't the solution, just a workaround for the U.S. > > censorship. The real solution would let RedHat ship it on their CDs. > > GnuPG (not GnuPGP) is in a lot better position, though -- it's produced > > o

Re: future Redhat security-patches updating policy ?

1999-10-03 Thread Chris Abbey
first off... opps... I've been reading about GnuPG for a week or so... but my mind kept seeing it as GnuPGP. At 18:13 10/3/99 -0400, Matt Wilson wrote: >So now, for the good news. Beginning with Red Hat Linux 6.1, all our >packages are GPG signed. Red Hat Linux purchased in the US includes >GPG

Re: future Redhat security-patches updating policy ?

1999-10-03 Thread Matt Wilson
On Sun, Oct 03, 1999 at 02:26:20PM -0700, H. Peter Anvin wrote: > > It can -- but it isn't the solution, just a workaround for the U.S. > censorship. The real solution would let RedHat ship it on their CDs. > GnuPG (not GnuPGP) is in a lot better position, though -- it's produced > outside the U

Re: future Redhat security-patches updating policy ?

1999-10-03 Thread H. Peter Anvin
Chris Abbey wrote: > > >sorry for my ignorance, but aren't PGP signatures included in every RPM ? > >I think when you are installing the rpm the rpm verifies the signature. > > every RPM *can* be PGP signed... not all are. > rpm *can* verify the signature of a signed RPM, *IFF* you have pgp inst

Re: future Redhat security-patches updating policy ?

1999-10-03 Thread Chris Abbey
>sorry for my ignorance, but aren't PGP signatures included in every RPM ? >I think when you are installing the rpm the rpm verifies the signature. every RPM *can* be PGP signed... not all are. rpm *can* verify the signature of a signed RPM, *IFF* you have pgp installed, and ask it to do so. Redh

Re: future Redhat security-patches updating policy ?

1999-10-03 Thread Benno Senoner
> > > > The problem is that Microsoft can cryptographically sign their > > packages whereas Redhat cannot (unless they use a NSA certified, > > closed-source system to do it). > > > > Digital signatures are essential for any live update system like > > this. > > > > Actually, RedHat can, and

Re: future Redhat security-patches updating policy ?

1999-10-02 Thread H. Peter Anvin
Damien Miller wrote: > > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > On Sat, 2 Oct 1999 [EMAIL PROTECTED] wrote: > > > Mandrake currently has something similar to this. Its a very very > > nice feature. It will poll mirrors close to you for updates, and you > > can install them right fr

Re: future Redhat security-patches updating policy ?

1999-10-02 Thread Damien Miller
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sat, 2 Oct 1999 [EMAIL PROTECTED] wrote: > Mandrake currently has something similar to this. Its a very very > nice feature. It will poll mirrors close to you for updates, and you > can install them right from the list that pops up. It reminds me

Re: future Redhat security-patches updating policy ?

1999-10-02 Thread Benno Senoner
On Sat, 02 Oct 1999, Chris Abbey wrote: > At 16:58 10/1/99 +0200, Benno Senoner wrote: > [...] > >comments ? > > none that haven't already been said... I can't emphasis enought the point > that others mention: if a company has that many Linux (or any form of *nix) > boxen then they must have a co

Re: future Redhat security-patches updating policy ?

1999-10-01 Thread rsk
Mandrake currently has something similar to this. Its a very very nice feature. It will poll mirrors close to you for updates, and you can install them right from the list that pops up. It reminds me a bit of WindowsUpdate, minus the rebooting :) Although I haven't messed with Mandrake all that mu

Re: future Redhat security-patches updating policy ?

1999-10-01 Thread Chris Abbey
At 16:58 10/1/99 +0200, Benno Senoner wrote: [...] >comments ? none that haven't already been said... I can't emphasis enought the point that others mention: if a company has that many Linux (or any form of *nix) boxen then they must have a competent admin group, and that group will use the tools

Re: future Redhat security-patches updating policy ?

1999-10-01 Thread Simon Epsteyn
> The ideal would be to have a little client on every RH distro shipped which ie > polls the REDHAT's central webserver (or maybe a custom server, the protocol > doesn't matter here), and retrieves information about which rpms have to be > updated, with flags describing the security urgency. Chec

Re: future Redhat security-patches updating policy ?

1999-10-01 Thread Joerg Mertin
On Fri, Oct 01, 1999 at 04:58:42PM +0200, Benno Senoner wrote: > Hi, [...] > The ideal would be to have a little client on every RH distro shipped which ie > polls the REDHAT's central webserver (or maybe a custom server, the protocol > doesn't matter here), and retrieves information about whic

future Redhat security-patches updating policy ?

1999-10-01 Thread Benno Senoner
Hi, recently I came across the hackpcweek.com issue, and the did not apply the crond exploit fix, since they "only install shipping software", and were not willing to install 21 different fixes ( from the redhat errata). But they installed Service Pack5 on NT, since it was one single file to inst