<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> Correct me if I'm wrong: the prompt to import a key is presented only after the user attempts to download software from that respective repository, right? Or am I mis-remembering? If that is the case, it could be useful to force the import when the repository is added to the software sources list. At least in that case, the user knows exactly what it is for, and that it is (theoretically) safe. On the other hand, if the key changes for some reason, it could then prompt the user with a big (very) scary message to ask for approval of the new key. Nate Patryk Zawadzki wrote: <blockquote cite="mid:89b6ba3a0806020544k2f85dabfn969f46595125ce34@mail.gmail.com" type="cite"> <pre wrap="">On Mon, Jun 2, 2008 at 2:12 PM, Benji Weber <a class="moz-txt-link-rfc2396E" href="mailto:benji@opensuse.org"><benji@opensuse.org></a> wrote: </pre> <blockquote type="cite"> <pre wrap="">b) It is not the easiest attack vector. If you wanted to do something malicious to a users' machine, why would you utilise a process that requires the user to trust your identity and be presented with warnings telling them that it is potentially a bad idea? It is considerably easier to get users to execute arbitrary binaries. </pre> </blockquote> <pre wrap=""> It will be the easiest attack vector as soon as users learn to just blindly click any 1-click-install button they can find. "Sure it has to be secure, it even gives some messages about security. Just click next." The other problem: imagine a third party repo being compromised. What can you do? How will you know? You probably read all the news related to your distro but do you follow all the FLOSS project pages? How can you detect and undo `rpm --import /tmp/hax0red.key` done in a legitimate looking rpm's %post? Plus I still don't get why it's ultimately better to get upstream packaging software for any distro. Not that any project has developers running all the available Linux flavors in all (un-)stable versions. The end result is foobuntu (no pun intended, insert any non-mainstream distro here) developers ignore a 0-day SCE as they do not ship said package while their users feel safe (no foobuntu SCE this month) running exploitable software. </pre> </blockquote> </body> </html>