On Wednesday 16 December 2009 11:14:22 Peter Eisentraut wrote:
> On mån, 2009-12-14 at 17:00 -0300, Alvaro Herrera wrote:
> > Magnus Hagander wrote:
> > > Yes.
> > >
> > > Ideally, we should serve up the MD5s from an SSL enabled webserver.
> > > Something to think about for the future.
> >
> > Shouldn't we distribute the MD5 signatures along the release message,
> > which should itself be signed with some appropriate GPG key?
>
> Someone was doing this a while ago on their own.
>
Greg Mullane was the one who used to do it.
> But the usual argument for the md5 files in the past was to catch
> download mistakes, not security.
Yes, though it would be nice to see us worry about both.
--
Robert Treat
Conjecture: http://www.xzilla.net
Consulting: http://www.omniti.com
