On Sat, 19 Apr 2014 17:33:06 +0000, Carlos E. R. wrote:
> On 2014-04-19 02:02, Jim Henderson wrote:
>> On Fri, 18 Apr 2014 23:48:06 +0000, Carlos E. R. wrote:
>>
>>> The file is indeed correct, but as it is not obtained directly from
>>> opensuse, the chain of trust is broken.
>>
>> The chain of trust isn’t necessarily broken - if you understand and
>> accept that the sync between sites is operating properly.
>
> The system of automated mirrors used by openSUSE enforces trust because
> metadata and some crucial files are always downloaded directly from the
> master server, never from mirrors. The system does not trust that sync
> is properly happening, it implements enforced verification methods.
Which rather makes my point.
>> Ultimately, you’re proposing a “problem” that tens of thousands (if not
>> more) of people have not seen as a problem, nor have they had a problem
>> with it.
>
> Millions did not see the problem with SSL. >:-)
True. So, do you have proof that the system has been compromised, or are
you just talking for something to do? Because you’re suggesting that it
has been compromised or could be compromised, in spite of a lack of
evidence that that has actually happened. So all of this is hypothetical/
theoretical at best.
>> You don’t like torrents because you think this level of risk is too
>> high? Great, don’t use them.
>
> Wrong. Actually, I like torrents. I was one of the initial beta testers
> of the openSUSE system.
Ah, so you’re arguing just for the sake of arguing. Got it. 
Jim
Jim Henderson
openSUSE Forums Administrator
Forum Use Terms & Conditions at http://tinyurl.com/openSUSE-T-C