Cryptographically enabled ports tree.

[Paul Robinson]

On Sat, Jun 21, 2003 at 08:36:25PM -0700, David Schultz wrote:

> I don't see why people need to update their ports tree more often than
> once a release.

Perhaps, because they don't want to run out of date software?
 
This ties in rather nicely in places with the packages discussion over on 
-hackers, but in essence, people should be able to keep their software 
patched and secure as easily as possible.

Would you rather be running an apache server where the MD5 checked, but it's 
not cryptographically signed OR would you rather run one which is 
crypto-signed but has a remote root exploit in it?

Paranoia is all well and good, but it's no replacement for common sense.

-- 
Paul Robinson