GNU Emacs 23.2 released

Considering the fact that gmane.com isn't secured, both are useless from a security viewpoint. It would be easier to intercept the request http://permalink.gmane.org/gmane.emacs.announce/17 and change the checksum that appears in the HTML, than to generate a new .tar.gz with the original checksum. If you can't trust that no one tampered with the checksum what good is it???

Re: GNU Emacs 23.2 released

#8

Post by cstuder » Sat, May 08, 2010, 1:33 PM UTC

[deleted] wrote: post #5

dublinclontarf wrote: post #4

Earlier quoted context omitted.

What should they be doing?

[deleted]

All hashes suffer from collisions (Otherwise they would be great compression tools). But a collision to an arbitrary MD5 hash cannot yet be easily calculated. And producing a working (malware) binary with the same hash would be quite a challenge.

So no, for these purposes, MD5 doesn't post a problem.

Re: GNU Emacs 23.2 released

#9

Post by swah » Sat, May 08, 2010, 1:53 PM UTC

geocar wrote: post #6

The NEWS file http://www.gnu.org/software/emacs/NEWS.23.2 is more helpful. * CEDET http://cedet.sourceforge.net/ is now part of emacs(!!!) * RMAIL now uses mbox

js.el is a new major mode for JavaScript files.

I think js2.el (Steve Yegge) was combined with javascript.el to make a new mode. Might be interesting...

Re: GNU Emacs 23.2 released

#10

Post by doty » Sat, May 08, 2010, 2:22 PM UTC

cstuder wrote: post #8

[deleted] wrote: post #5

Earlier quoted context omitted.

[deleted]

All hashes suffer from collisions (Otherwise they would be great compression tools). But a collision to an arbitrary MD5 hash cannot yet be easily calculated. And producing a working (malware) binary with the same hash would be quite a challenge. So no, for these purposes, MD5 doesn't post a problem.

That doesn't appear to be true. From http://www.mscs.dal.ca/~selinger/md5collision/:

It is now well-known that the crytographic hash function MD5 has been broken. [...] The following is an improvement of Diaz's example, which does not need a special extractor. Here are two pairs of executable programs (one pair runs on Windows, one pair on Linux) [...] Here, you can download the software that I used to create MD5-colliding executable files.