GNUzilla - News: GNU IceCat 3.6.13 released
[Submit News]
[38 news in archive]
GNU IceCat 3.6.13 released
Item posted by Giuseppe Scrivano <gscrivano> on Tue 14 Dec 2010 11:46:39 PM UTC.
The new version includes changes made upstream by Mozilla Firefox
3.6.13.
In addition, this new version includes some new privacy features which
block some techniques used by Evercookie[1] to store data on the
local browser even if cookies were blocked.
It is available for download here:
ftp://ftp.gnu.org/gnu/gnuzilla/3.6.13/icecat-3.6.13-i686.tar.bz2
ftp://ftp.gnu.org/gnu/gnuzilla/3.6.13/icecat-3.6.13-i686.tar.xz
ftp://ftp.gnu.org/gnu/gnuzilla/3.6.13/icecat-3.6.13.tar.bz2
ftp://ftp.gnu.org/gnu/gnuzilla/3.6.13/icecat-3.6.13.tar.xz
ftp://ftp.gnu.org/gnu/gnuzilla/3.6.13/privacy_ext.xpi
and the GPG detached signatures using the key C03363F4:
ftp://ftp.gnu.org/gnu/gnuzilla/3.6.13/icecat-3.6.13-i686.tar.bz2.sig
ftp://ftp.gnu.org/gnu/gnuzilla/3.6.13/icecat-3.6.13-i686.tar.xz.sig
ftp://ftp.gnu.org/gnu/gnuzilla/3.6.13/icecat-3.6.13.tar.bz2.sig
ftp://ftp.gnu.org/gnu/gnuzilla/3.6.13/icecat-3.6.13.tar.xz.sig
ftp://ftp.gnu.org/gnu/gnuzilla/3.6.13/privacy_ext.xpi.sig
To reduce load on the main server, you can use this redirector service which automatically redirects you to a mirror:
http://ftpmirror.gnu.org/gnuzilla/3.6.13/icecat-3.6.13-i686.tar.bz2
http://ftpmirror.gnu.org/gnuzilla/3.6.13/icecat-3.6.13-i686.tar.xz
http://ftpmirror.gnu.org/gnuzilla/3.6.13/icecat-3.6.13.tar.bz2
http://ftpmirror.gnu.org/gnuzilla/3.6.13/icecat-3.6.13.tar.xz
http://ftpmirror.gnu.org/gnuzilla/3.6.13/privacy_ext.xpi
Comments:
| Checksum Request - MD5 and SHA1 (posted by David G.V. Ray, Sun 13 Feb 2011 12:43:44 AM UTC) |
Thanks for the new release Giuseppe.
Can we please have the corresponding checksum values when you get a chance.
Best regards,
David |
| RE: Checksum Request - MD5 and SHA1 (posted by David G.V. Ray, Wed 16 Feb 2011 02:56:27 PM UTC) |
Giuseppe wrote to me via email saying:
"Hi David,
I haven't used them because they are not secure. The safe way to check the package is using the detached GPG signature.
Cheers,
Giuseppe" |
| RE: Checksum Request - MD5 and SHA1 (posted by David G.V. Ray, Wed 16 Feb 2011 02:59:36 PM UTC) |
I wrote to him again:
"Hi Giuseppe,
Thanks for the update. I've checked the signature using the Terminal command "gpg - - verify privacy_ext.xpi privacy_ext.xpi.sig".
You're signature was Authenticated.
However, I can't check that the file that you've made available hasn't been altered by checking against your checksum.
Can you let me know why you believe that the checksum system isn't secure.
In most organizations Its been a standard practice to checksum all software.
Thanks and best regards,
David" |
| RE: Checksum Request - MD5 and SHA1 (posted by David G.V. Ray, Wed 16 Feb 2011 03:01:05 PM UTC) |
Giuseppe wrote back:
"gpg --verify ensures that the file hasn't been altered, no need to checksum it.
Checksumming is not safe since the checksum itself is sent over a non-secure channel, that is an e-mail. An e-mail can be altered, so the checksum can be changed as well.
Basically you could get both a modfied version of the package and the correspondending checksum, you assume you got the original package but it couldn't be the case.
Cheers,
Giuseppe" |


