Re: signing applets a solution? Never!

[chuck yerkes <Chuck () yerkes com>]

It is claimed, but unverified, that Darren Reed wrote:
[...] 
> To add to the "scariness", in a local magazine article on hackers,
> one hacker was quoted as his goal being to break in and get access
> to source code so they could insert backdoors which only they know
> about.  This wasn't your average hacker who read CERT bullitins or
> bugtraq just to try discover new holes and get into as many sites
> as possible, this type seem to have purpose.  It would be stupid to
> assume that this goal of getting access to source code is never
> realised.

And I must say that a former (and brief) (and, for my legal safety,
perhaps hypothetical) employer showed little care that getting to
their source was possible/easy.

Perhaps RCS with pgp signing is in order?

  Buying third party security software?  What about folks 'helping'
with other freeware (Kerberos, X-Windows, *BSD, IPFilterD, the
compiled apps put up on vendors' ftp servers as a service), how
closely are those changes monitored?  I know Kerberos' sources
are closely watched, but who watches the watchers?

What if Ranum or Venema has been replace by the pod people?  :)
But I digress.

chuck