Re: Concerns about locale .lu Mirror of the PHP Project

That's why we have MD5 checksums listed alongside each download. Check the md5, if it is different from the one listed at the main php.net server, don't use it. Unless you have some real evidence of any sort of wrongdoing or if we find the mirror is unreliable, I see absolutely no reason to do anything. -Rasmus On Fri, 4 Oct 2002, Tom Weber wrote: > Hello, > > I saw today, being from Luxembourg, that we have here a new Mirror Server > for PHP , namely "http://lu.php.net/". This > frightened me > immediately and I said to myself, oh my god, official software on a "well > known" host operated by children without any serious background (neither > on the technical site, nor on the legal), how can this happen. After having > my download at another server, for instance in belgium, where I am at least > sure that the Provider is a serious company. Being responsible for the most > visited site here in Luxembourg (for instance, RTL.lu the portal for Radio & TV > over here), operating 10 Apache/PHP dedicated Servers, by this fact being very > focused on security hazards, I thought, free Your mind by sending apache a mail > to introduce some keyfacts which I have, but others may perhaps not. > > I am just wondering if You are aware of these facts, that a bunch of kiddies > on hack/shell account servers can host official software, because I am concerned > that the same fact will happen once again as with the OpenSSL Software where > somebody was able to introduce a Trojan into the official distribution and made > people like You and me a lots of hours to fix it once again. > > I do not want to act as a nasty guy who does not want these people to do such service, > but I am concerned about this fact which may represent a potential danger to the > Luxembourg Community, which rely on Your strong products, to be put a little Trojan horse > onto their ServerSoftware. > > If there is a real need from Your Site for a local Luxembourg mirror, I am sure > we can find an arrangement, either RTL (The biggest internet portal, TV & Radio > Provider in Luxembourg, and even across Europe) or any of our local "serious" > company's having a real headquarter and statutes in Luxembourg, will be willing > to post such mirror. If the need is present, I can check over here on the field > to find some of these people. Being a founding member of ISOC and ISPA (Internet Service > Provider Association), we are all concerned about this fact. > > Greetings, > > Tom Weber > > Head of Technical and R&D Department > RTL newMedia Luxembourg / RTL Group > Member of ISOC / ISPA > >