Mozilla is a virus

Security

It also provides a good argument for the signing of executables that MS always does. At least there you know that the file hasn't been tampered with.

Of course, that doesn't mean it's clean; the file could've been infected from the beginning, and the infected copy signed. But that's a whole lot less likely to happen than it getting effected when distributing it to various servers.

Nice....

Sometimes (I've had it before) you get a malformed compile (broken binary) and it apears to the computer as a virus. However knowing how Asa felt about Linux on the desktop who knows they may have purposly made it that way (joking).

This site is to MS as Slashdot is to Linux. Did you actually try and read the link you posted? Is MS responsible if idiots downloads patches from p2p, and find that they get infected? The Korean server is not an affiliated Mozilla site, it's just any old fan site. Yawn.

SvendTofte wrote:

This site is to MS as Slashdot is to Linux. Did you actually try and read the link you posted? Is MS responsible if idiots downloads patches from p2p, and find that they get infected? The Korean server is not an affiliated Mozilla site, it's just any old fan site. Yawn.

Don't shoot the messenger.

LarryOsterman wrote:

Svend, if the binary had been signed, then it would have been irrelevant

I thought Mozilla did sign their binaries. (Downloads latest firefox setup.exe...) Yup, it's signed.  The code signing certificate was issued 12/24/2004, so they have been signing binaries since at least that time.

The Linux .tar.gz's also have .asc's sitting right next to them (the Linux equivalent of a signed executable)

LarryOsterman wrote:

For *nix, does the infrastructure force the inspection of the ASCs?  In other words, if someone doesn't manually verify the ASC file, what happens?

If the OS doesn't say "hey, the signature on this file isn't the right file" then there's a problem.

The RPM package format allows signing. And yes, RPM will warn you if the signature doesn't match the file on install.

LarryOsterman wrote:

For *nix, does the infrastructure force the inspection of the ASCs?

Nope - *nix gives you enough rope to hang yourself with.  For .tar.gz's, anyway.  RPMs are another matter.

LarryOsterman wrote:

In other words, if someone doesn't manually verify the ASC file, what happens?

Whatever the user types.  Usually the following recipe:

wget http://www.example.com/foo.tar.gz

# BEGIN OPTIONAL PART

# download the signature
wget http://www.example.com/foo.tar.gz.asc

# download vendor public key - get this from a reliable source
# note this only needs to be done once per vendor
# some vendors expire their keys once a year
wget http://www.example.com/KEY

# say "I trust that this key is what it says it is"
# also only needs to be done once per vendor
gpg --import KEY

# verify that file is what the signature says it is
# this also says who signed it
gpg --verify foo.tar.gz.asc

# END OPTIONAL PART

tar xzvf foo.tar.gz
cd foo
make
make test
su -c "make install"

If the optional stuff is skipped, the installation takes place without trust-verification.

LarryOsterman wrote:

If the OS doesn't say "hey, the signature on this file isn't the right file" then there's a problem.

It's not the epitome of usability, that's for sure.

If you want to compile from source and still want automatic signature checking of the downloaded source package, there's always *.src.rpm.