jida...@jidanni.org a écrit :
> So what's the worst thing that could happen to me with sa-update
> --nogpg? Just a little more spam getting through? Ha!
>
>> If you would just follow instructions, you wouldn't need --nogpg
>
> Yes, well, let's just say things didn't work out, and we want to use
> --nogpg just for that risky feel. Like smoking cigarettes or
> something. So what's the worst thing that could happen, our mailbox
> getting cancer?
not clear whether you are asking for information or whether this is
ironic. I'll assume the former.
If your DNS is poisoned, you may get updates from another server. if
there is a vulnerability in SA that can be triggered by specific rules,
then you just opened your server to such attacks.
you may say that attackers could own a channel server. but:
- it is reasonable to assume that channel servers are "reasonably well run"
- channels are used by a lot of people. so an attack on the channels
will be detected sooner than an attack on your server
...
Ok, that may look theoritical. but since it is easy to use sa-update
without --nogpg, there is no point to use --nogpg.
(The 403 problems you had have nothing to do with gpg.)
PS. backscatter with
supp...@dss.dounsix.local
Unrouteable address
has started again. I now blocked .orcon.net.nz (I am too lazy to find a
"more appropriate" way). If a list admin could find the guilty member
and remove him...
