Susan said:
I'm having trouble envisioning this kind of problem. IMO the CD files
should be as safe or safer than downloaded files.
The difference is that the person doing the duplication has the install files on
his/her hard disk, and thus has the possibility of tampering with them.
Of course the risk exists also on websites, but reputable sites have a stake in
not doing it (their reputation), which a private hacker would not.
Suppose a little scum laces some of the files in the distro with a keylogger,
for ex. S/He thus gets a copy of relevant info from the PCs of those who install
it. If the hacker is smart/nasty/greedy, the focus could be on getting, say,
userids/psw for accounts with Amex, Visa, Mastercard, BancOne and suchlike.
The possibilities for misuse by a smart hacker are interesting, really.
The consequences, one can only imagine. Besides the stain on the reputation of
PL (which might even the motivation for a payware author), the potential claims
for damages under a screwed up legal system like the US one, etc.
Look, Susan. I am not trying to discourage anyone from the idea. I only point
out that a single black sheep could cause damage, or create exposure to
liabilities, for a lot of people unless some precautions are taken.
Maybe it is easy to protect against that risk, maybe not. I don't know, IANAL. I
just advocate that people should consider it before plunging. Things like a list
of CRC sums of the distros on a webpage, some legal disclaimers, stuff like
that, may be enough. Maybe not. I suggest that someone with understanding of
legal exposure issues should look into it.
Me, I like the idea and wish everyone all the best, but personally I won't touch
re-distribution with a 10-foot pole. Distrustful old fart, here.
Take care
DAN
-))