Re: CVS server key

[Geraint Paul Bevan]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

John W. Eaton wrote:

| I changed the hardware that runs www.octave.org and the host key did
| change.  I have not posted the host key anywhere.  Where should I post
| the host key?  I'm not sure that it would help to post it on
| www.octave.org, since that is the same system where the cvs archive is
| kept, so if the system is compromised, it would not be possible to
| guarantee the host key shown on the web site.  Or am I missing
| something?
|
| jwe


If someone were to compromise the octave.org machine, they would be able
to insert malicious code without touching the host key so it wouldn't
offer any protection in that case. Where it could perhaps be useful is
if a man-in-the-middle attack were to take place with someone
interfering with data passing between the user and octave.org.

In this case, even though the attacker could presumably interfere with
any attempts to read the key on octave.org, it may still be possible for
~ the user to detect a problem if they are able to check the google cache
of the site without interference.

- --
Geraint Bevan
http://homepage.ntlworld.com/geraint.bevan

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iEYEARECAAYFAkFpALUACgkQcXV3N50QmNOvyACfc0eOKIGOJsB6F2wToEWNEG8o
LMcAn3qd/11n3G8VBuu3iuf8xb8fHuTy
=ozRb
-----END PGP SIGNATURE-----



-------------------------------------------------------------
Octave is freely available under the terms of the GNU GPL.

Octave's home on the web:  http://www.octave.org
How to fund new projects:  http://www.octave.org/funding.html
Subscription information:  http://www.octave.org/archive.html
-------------------------------------------------------------