[arch-general] Kernel.org compromised. Are Arch users safe? - Arch-general - lists.archlinux.org

newer
[arch-general] New GTK update make...

[arch-general] Kernel.org compromised. Are Arch users safe?

older
[arch-general] only root can...

Paulo Guedes

1 Sep 2011 1 Sep '11

2:30 p.m.

Since mirrors.kernel.org is one of the main mirrors used in Arch what's the best measureus to take right know? Format the computer and reinstall arch? Uninstall any update since last week?

Show replies by thread

Alfredo Palhares

1 Sep 1 Sep

2:34 p.m.

New subject: [arch-general] Kernel.org compromised. Are Arch users safe?

What ? You make no sense 2011/9/1 Paulo Guedes

Since mirrors.kernel.org is one of the main mirrors used in Arch what's the best measureus to take right know? Format the computer and reinstall arch? Uninstall any update since last week?

-- Regards, Alfredo Palhares

Ionut Biru

2:35 p.m.

New subject: [arch-general] Kernel.org compromised. Are Arch users safe?

On 09/01/2011 03:30 PM, Paulo Guedes wrote:

Since mirrors.kernel.org is one of the main mirrors used in Arch what's the best measureus to take right know? Format the computer and reinstall arch? Uninstall any update since last week?

kernel.org != mirrors.kernel.org just to be clear -- Ionuț

Tom Gundersen

2:47 p.m.

New subject: [arch-general] Kernel.org compromised. Are Arch users safe?

On Thu, Sep 1, 2011 at 2:35 PM, Ionut Biru wrote:

On 09/01/2011 03:30 PM, Paulo Guedes wrote:

...
Since mirrors.kernel.org is one of the main mirrors used in Arch what's the best measureus to take right know? Format the computer and reinstall arch? Uninstall any update since last week?

kernel.org != mirrors.kernel.org just to be clear

In any case, the packages on mirrors.kernel.org have been checked, and they are not compromised. -t

Paulo Guedes

3:03 p.m.

New subject: [arch-general] Kernel.org compromised. Are Arch users safe?

Then there isn't any need to worry and everything is safe, right? Thanks. On 1 September 2011 13:47, Tom Gundersen wrote:

On Thu, Sep 1, 2011 at 2:35 PM, Ionut Biru wrote:

...
On 09/01/2011 03:30 PM, Paulo Guedes wrote:

...
Since mirrors.kernel.org is one of the main mirrors used in Arch what's the best measureus to take right know? Format the computer and reinstall

arch?

...
Uninstall any update since last week?

kernel.org != mirrors.kernel.org just to be clear

In any case, the packages on mirrors.kernel.org have been checked, and they are not compromised.

-t

Denis A. Altoé Falqueto

5:02 p.m.

New subject: [arch-general] Kernel.org compromised. Are Arch users safe?

On Thu, Sep 1, 2011 at 10:03 AM, Paulo Guedes wrote:

Then there isn't any need to worry and everything is safe, right?

As long as the keys used to sign the tar balls arent't compromised, we shouldn't worry. They weren't, according to kernel.org admins. I don't know if Arch kernel maintainers check the signatures, but it is easy do to it now, if needed be. And makepkg from next pacman's release will have an option to check signatures automatically, easing the process even more. -- A: Because it obfuscates the reading. Q: Why is top posting so bad? ------------------------------------------- Denis A. Altoe Falqueto Linux user #524555 -------------------------------------------

Pierre Schmitz

7:45 p.m.

New subject: [arch-general] Kernel.org compromised. Are Arch users safe?

On Thu, 1 Sep 2011 14:47:40 +0200, Tom Gundersen wrote:

On Thu, Sep 1, 2011 at 2:35 PM, Ionut Biru wrote:

...
On 09/01/2011 03:30 PM, Paulo Guedes wrote:

...
Since mirrors.kernel.org is one of the main mirrors used in Arch what's the best measureus to take right know? Format the computer and reinstall arch? Uninstall any update since last week?

kernel.org != mirrors.kernel.org just to be clear

In any case, the packages on mirrors.kernel.org have been checked, and they are not compromised.

-t

I cannot find the original mail but only this copy (someone might want to check the signature) http://pastebin.com/BKcmMd47 This states that also the mirrors might have been affected. While we can quite easily ensure that there are no compromised packages atm we don't know if there were some in the past. But this is in no way different than using any other mirror; in general using any Arch mirror is insecure. That's why some smart people are working hard on package signing. Greetings, Pierre -- Pierre Schmitz, https://users.archlinux.de/~pierre

4619

Age (days ago)

4619

Last active (days ago)

Download

6 comments

6 participants

tags

participants (6)

Alfredo Palhares
Denis A. Altoé Falqueto
Ionut Biru
Paulo Guedes
Pierre Schmitz
Tom Gundersen