This is the mail archive of the
cygwin-talk
mailing list for the cygwin project.
Re: MD5s of setup.exe on mirrors.
- From: Christopher Faylor <cgf-use-the-mailinglist-please at cygwin dot com>
- To: The Cygwin-Talk Maiming List <cygwin-talk at cygwin dot com>
- Date: Mon, 14 May 2007 15:53:46 -0400
- Subject: Re: MD5s of setup.exe on mirrors.
- References: <o7d5164e3s.fsf@hod.lan.m-e-leypold.de> <063001c7947a$3312cea0$2e08a8c0@CAM.ARTIMI.COM> <lblkfu5olv.fsf@hod.lan.m-e-leypold.de> <46461FA2.E6EFA773@dessent.net> <i646w3lyh.fsf@hod.lan.m-e-leypold.de> <20070513161110.GA5651@ednor.casa.cgf.cx> <46489A67.7090503@determina.com> <4648A523.1010705@cygwin.com> <20070514182135.GA6692@trixie.casa.cgf.cx> <072301c7965a$8b60fa00$2e08a8c0@CAM.ARTIMI.COM>
- Reply-to: cygwin-talk at cygwin dot com
- Reply-to: The Cygwin-Talk Maiming List <cygwin-talk at cygwin dot com>
On Mon, May 14, 2007 at 08:03:23PM +0100, Dave Korn wrote:
>[ bock-bock because it's getting a bit tired on the main list and the actual
>issue is long since dealt with. ]
>
>On 14 May 2007 19:22, Christopher Faylor wrote:
>
>> On Mon, May 14, 2007 at 02:06:27PM -0400, Larry Hall (Cygwin) wrote:
>>> Alexander Sotirov wrote:
>>>> Christopher Faylor wrote:
>>>>> It was actually all academic before since: 1) there was nothing wrong
>>>>> with the setup.exe on the mirrors and 2) people shouldn't have been
>>>>> running setup.exe from the mirrors to begin with.
>>>>
>>>> Can you elaborate on why people shouldn't run setup.exe from the mirrors?
>>>> I
>>>> don't see what is the difference between setup.exe and the other
>>>> packages. If
>>>> you trust the mirror for all other binaries, why don't you trust it for
>>>> setup.exe?
>>>
>>> Propagation time delays would be one reason. Since it's easy to grab
>>> 'setup.exe' from the source, there's no sense using one that might be
>>> dated.
>>
>> That + if you want to talk about trust then you should trust the method
>> that we advertise for installing cygwin which is to click on the
>> "Install Cygwin Now!" link.
>
> But that /still/ doesn't differentiate between "setup.exe" and any other
>random .exe found in the installed packages, so it doesn't explain why there
>is a discrepancy in the rules for trusting one particular .exe as compared to
>any other.
It's too bad the spam filter blocks profanity.
cgf