My original post called for unit to unit text messaging services to be built. Text services! Not for the cell companies to connect millions of phone calls at a time.
The main concern is that a bad mirror or website spoofer could distribute a maliciously modified version of Firefox. Checksums only assure that data hasn't been corrupted by an unintentional machine error. A spoofer would publish a checksum corresponding to the spoofed software. Project Leaders need to use digital signatures on the checksums to show that a download hasn't been spoofed. Digital signatures can be verified with a trusted OpenPGP key or a X.509 certificate approved by a popular certificate authority (like Verisign)
Mozilla.org already uses OpenPGP keys. Check out the *.asc files in http://ftp.mozilla.org/pub/mozilla.org/firefox/rel eases/1.0/
Those *.asc files are checksums signed with the OpenPGP key listed in the "KEY" file. The only problems with this system are:
Most people don't understand or use OpenPGP programs
I don't know if Chase Phillips (the KEY owner) would purposely sign malicious software
I don't know if Chase Phillips has truely generated and operated that keypair
I know none of the people who have signed Chase Phillips key. If I was certain that one of them would only sign the key after checking Chase's identity, I would feel reasonably secure that the key is controlled by Chase. It would help immensely if a widely trusted entity like Verisign would verify and sign Chase's key.
Slashdot Mirror
How many FLOSS projects have never begun or have less features because developers are afraid of patent lawsuits?
My original post called for unit to unit text messaging services to be built. Text services! Not for the cell companies to connect millions of phone calls at a time.
Most people don't understand or use OpenPGP programs
I don't know if Chase Phillips (the KEY owner) would purposely sign malicious software
I don't know if Chase Phillips has truely generated and operated that keypair I know none of the people who have signed Chase Phillips key. If I was certain that one of them would only sign the key after checking Chase's identity, I would feel reasonably secure that the key is controlled by Chase. It would help immensely if a widely trusted entity like Verisign would verify and sign Chase's key.