There will be no changes to how Canonical handles GnuPG in their repos.
This is an obscure IRC chat server app, that only shows how inept some people can be.
Gentoo is one of the few distros that requires you to compile from tar.gz EVERYTHING.
I doubt they have the resources to verify/test code or certify vendor software.
With Gentoo you literally compile your own kernel before downloading tarballs to yet do more compiling.
I know b/c I've tried Gentoo. Is this necessarily a bad practice in terms of implementation? That's something for a separate debate.
But, the risks of accepting any vendor's source remain.
Distros must keep up their guard to ensure that all code admitted to the repo is certified clean and safe to use.
That has been a sticking point for Canonical who don't 'willy-nilly' let source find its way into Ubuntu. It's a careful vetting certification process and if you scroll through the Synaptic database, only select programs have Canonical's blessing for support (LTS).
Stay in the GPG 'ring of safety' repo and you are fine with Ubuntu Linux.
The revelation that the open-source Unreal IRC server download has been infected with malware for some eight months is pretty worrying. But the added discovery that this Trojan horse made its way into the Gentoo distro is real reason for the Linux community to re-examine how trusted repositories are handled.
It’s true that compared to Windows, Linux is pretty safe bet if you want to remain protected from hackers. After all, the 1% or so usage share that the OS enjoys (combined with the fact that many of its users are pretty switched on) just doesn’t make it a worthwhile target to go after.
But there’s a big difference between the OS being a “pretty safe bet” and it being invulnerable. No OS is invulnerable. If someone wants in on your system, and they have the time and resources, they are likely to find a way.
But this is a major blunder. Allowing infected code to make its way into an official distro demonstrates how complacent some in the Linux community have become.
Which leads to the biggest and most important question of all - how can we, as Linux users, be sure that more malware hasn’t infiltrated official channels?
The idea that we can blindly trust official repositories of open source code is slowly eroding. Earlier this year Mozilla discovered that it had been hosting a Firefox add-on that contained malware. This latest incident should underline the need to beef up security to protect users.
