On Wed, 06 May 2009 22:16:44 +0200, jdd wrote:

Jim Henderson a écrit :

...

Perhaps, I don't know if the rpm database uses md5sum or not, but even if it does, the md5sum algorithm is well known and could be implemented into the piece of software that's checking.

and what will this prove? any malware can insert the md5sum in the file. md5sum have to be fetched from a trusted source (this is usefull) - but if in the first place you dl the program from a trusted source, you shouldn't have any problem of that sort.

So you sign the database containing the checksums. That certainly will prove a fair bit. But also, most malware is not written to take into account the different ways a system protects itself. It's written with a very specific purpose in mind. Today's malware is smarter than that of 20 years ago, but at the same time, it isn't written to take into account every possible way of preventing it from doing it's work. Much malware out there today depends on wide distribution so if one node doesn't get infected, it doesn't matter much to the authors of the malware. Jim -- Jim Henderson Please keep on-topic replies on the list so everyone benefits -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org