DUO - MFA

[Bryan E. Wooten]

>Just from the perspective of the project, no, it wouldn't. Maven does not provide a mechanism to validate the authenticity of artifacts it uses in a build, so using >any repository you don't control is a significant security bug while building software.

>It's one thing to do a bad job of authenticating artifacts initially (that's almost implied, we just don't have much to go on with so few artifacts signed by trustworthy >keys), but building software such that you repeatedly pull in untrusted code is mind boggling.

>-- Scott

Yes Scott, I understand your concern. There was a post on reddit last week about this and it caught my attention. (stupid reddit search is useless so I can't find the original post)

Today, I found this:

http://central.sonatype.org/articles/2014/Aug/03/https-support-launching-now/

What is your opinion of jar signing and checksums as mitigating factors.

-Bryan

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net