Re: location of md5 files ...

On Wednesday 16 December 2009 11:14:22 Peter Eisentraut wrote:
> On mån, 2009-12-14 at 17:00 -0300, Alvaro Herrera wrote:
> > Magnus Hagander wrote:
> > > Yes.
> > >
> > > Ideally, we should serve up the MD5s from an SSL enabled webserver.
> > > Something to think about for the future.
> >
> > Shouldn't we distribute the MD5 signatures along the release message,
> > which should itself be signed with some appropriate GPG key?
>
> Someone was doing this a while ago on their own.
>

Greg Mullane was the one who used to do it.

> But the usual argument for the md5 files in the past was to catch
> download mistakes, not security.

Yes, though it would be nice to see us worry about both.

--
Robert Treat
Conjecture: http://www.xzilla.net
Consulting: http://www.omniti.com