From ripley at stats.ox.ac.uk  Mon May 11 17:19:35 2015
From: ripley at stats.ox.ac.uk (Brian Ripley)
Date: Mon, 11 May 2015 16:19:35 +0100
Subject: [Rd] Wrongly checked MD5 checksums in R 3.2.0's windows binary
In-Reply-To: <83A03E80-691B-4B15-A80F-5A7111DB0C29@gmail.com>
References: <CANdJ3dU=D8qriq2wO7tZb+UYWi3oiLxmC+TdV1yLQBJAOdf5Tg@mail.gmail.com>
	<21840.24595.738590.906123@stat.math.ethz.ch>
	<70B6F453-1F65-4C23-89CB-52597D3476E4@gmail.com>
	<55507125.20100@gmail.com>
	<CANdJ3dXCh7-BxF6Xii3Wa1UuHeUCoGJOdNepEzrwzRDBRcEB6A@mail.gmail.com>
	<5550AC18.6080706@gmail.com>
	<CANdJ3dWSaYQJ3avnwNaoduc08wBKzpNGBga=gkMy7MsrSiyX8Q@mail.gmail.com>
	<5550B45A.7040504@gmail.com>
	<83A03E80-691B-4B15-A80F-5A7111DB0C29@gmail.com>
Message-ID: <455470B4-922F-4EBC-8D68-058AC9D09CCC@stats.ox.ac.uk>



> On 11 May 2015, at 16:00, peter dalgaard <pdalgd at gmail.com> wrote:
> 
> 
>> On 11 May 2015, at 15:53 , Duncan Murdoch <murdoch.duncan at gmail.com> wrote:
>> 
>> On 11/05/2015 9:35 AM, Tal Galili wrote:
>>> Hi Duncan,
>>> Thank you for the clarification. :)
>>> 
>>> I ended up removing these files from being scanned in the updated version of installr. I would rather focus on supporting an MD5 scan that is based on what is listed in MD5 file itself (ignoring exceptions that are not clearly stated in the file).
>> 
>> I'm not sure what the purpose is of your test, but if it is to detect modified files, that might not be a good strategy.  A malicious agent could install fake bin/R.exe or bin/Rscript.exe and not be caught.
>> 
>> Of course, if they knew to modify those two files but not any others, they would know enough to also install a fake MD5 file, and then there's basically nothing you could do.
>> 
>> Duncan
> 
> As a general matter, checksumming is useless against tampering if you ship the checksums with the files (that's why I put the checksums in the release announcements: so that they travel alon a different route to the user). If you do, they only make sense as safeguards against technical errors (such as the infamous CR/CRLF conversions).

And that (including unpacking errors by rogue unzip clients) is precisely what they are there in the binary packages for.

> 
> I still don't get why Tal refuses to work out the apparently quite simple logic that decides which checksums should be used to check the installed R.exe and Rscript.exe.
> 
> -- 
> Peter Dalgaard, Professor,
> Center for Statistics, Copenhagen Business School
> Solbjerg Plads 3, 2000 Frederiksberg, Denmark
> Phone: (+45)38153501
> Email: pd.mes at cbs.dk  Priv: PDalgd at gmail.com
> 
> ______________________________________________
> R-devel at r-project.org mailing list
> https://stat.ethz.ch/mailman/listinfo/r-devel



[Rd] Wrongly checked MD5 checksums in R 3.2.0's windows binary
Brian Ripley