Re: Summary/Minutes for Wednesday's FESCo meeting (2012-12-05)

On Wed, Dec 05, 2012 at 03:20:14PM -0500, Bill Nottingham wrote: how is not providing a supported way to do secure upgrade of Fedora not a regression? It is a big disappointment that Fedora is more and more turning its back on security. If I remember correctly, Fedora was one of the leading distributions providing and using signed packages. But with time this is more and more invalidated and people are more and more expected to install unsigned packages or not to verify them. At least back in 2010 malicious mirrors were still acknowledged as a security risk for Fedora users and signed packages were mentioned as a counter measure: https://fedoraproject.org/wiki/Mirror_manager_security_risks How come it became less important now? Actually it is even easier to attack users as more and more mobile devices are used. And what is even worse, the whole problem of not verifying packages on upgrade or the upgrade image itself is not even prominently communicated. There is nothing in the release notes about this: http://docs.fedoraproject.org/en-US/Fedora/18/html/Release_Notes/sect-Rel... I am very disappointed about this and I think this this a bad decission. :-( Regards Till