Tag Info

New answers tagged

1

Whatever your strategy, I think the first step is to sign your patches. No matter how many MITM there are, if the users can check your signature in a way they trust that will already provide a massive amount of certainty. HTTPS is good, but it doesn't really do as much as the signature on your patch, HTTPS will make MITM more difficult, but not impossible. ...


0

All updates in Ubuntu are signed and the signature is verified relatively to the PGP public keys install to that effect. A package won't be accepted as genuine unless its signature matches one of the keys. These keys are themselves installed and updated through the ubuntu-keyring and ubuntu-extras-keyring packages. If an attacker manages to alter these ...


1

Okay, I've done some investigation on this one. I still can't find any word from MS about it - presumably they feel it's such an obvious thing to do that it needs no such assertion. Examining the WindowsUpdate.log file suggests that signature checking is taking place, and examining the wuaueng.dll file with a debugger verifies this. Windows update will ...



Top 50 recent answers are included