Re: CVS server key

[Geraint Paul Bevan]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Jon H. Davis wrote:
| On Sun, 2004-10-10 at 05:42, Francesco Potorti` wrote:
|
|>>change.  I have not posted the host key anywhere.  Where should I post
|>>the host key?
|>
|>Why not on this list?
|
|
|     Why is there any need to do anything? The ssh client tells you when
| the host key changes, and offers to update your .ssh files after giving
| you the warning that it has changed. End of story.
|

It was that notification from the ssh client that started this topic.

Before ever connecting to the CVS server on octave.org, the client's
hosts file doesn't know the correct key. Ideally, a user should be able
to check that they are communicating with the real server before
downloading, compiling and then executing the code.

Whenever the key changes, the client can notify you that the key has
changed, but it can't tell you *why* - whether it is due to a hardware
change (as in this case) or an attacker. A message to this mailing list
would certainly solve the problem in this second case.

- --
Geraint Bevan
http://homepage.ntlworld.com/geraint.bevan

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iEYEARECAAYFAkFppk4ACgkQcXV3N50QmNOi+gCfeookc3cKHO25TTii8vYRaED4
BkEAnRNU/HZXUBbVT7Gp+TkmjuhIdHnH
=dbND
-----END PGP SIGNATURE-----



-------------------------------------------------------------
Octave is freely available under the terms of the GNU GPL.

Octave's home on the web:  http://www.octave.org
How to fund new projects:  http://www.octave.org/funding.html
Subscription information:  http://www.octave.org/archive.html
-------------------------------------------------------------