[SM-Discuss] Threat profile analysis for spackages not signed by authors
Sergey A. Lipnevich
sergey at optimaltec.com
Wed Aug 31 19:52:02 EDT 2005
On Wed, 2005-08-31 at 16:00 -0700, Seth Alan Woolley wrote:
> We can spend all day coming up with attack vectors:
It's not my idea. It's what people do when they try to protect
something: they decide who or what is going to endanger the protected
entity. I believe it's called threat profile analysis, but don't take my
word for it.
> Personally, signed by guru anywhere is acceptable to me. HOWEVER, I've
> proposed ways to resolve this conflict: 1 is with DETAILS signing, and 2
> is with anonymous key names with a clickthrough wrapper over the
> security policy to find the identity. 2 is cleanest (and not everybody
> has to participate), but 1 is "I'll put up with it". Sergey seems to
> have rejected number 2.
> I fear though we'll lose Sergey if the clean method is proposed, but I
> just don't see any reason why he can't use the clean method other than
> an irrational fear or out of spite.
Yes. It's not irrational. I develop software for living, so I learned
not to trust 3rd party code though my professional experience. It
doesn't mean that I don't use it, I do a lot, but part of my desire to
stick to open source and free[dom] software is that closed source is
more difficult to trust. Also, breaches of sites like gnu.org are very
> Lastly, we all need to let our egos take a step back and let Sergey and
> Arwed think about for a bit before pushing somebody to a decision. I
> hope all that's needed to be said has been said at this point and a
> little reflection will resolve the situation.
I'm far from pushing anybody. On the contrary, I consider myself pushed,
but that doesn't matter who's the bully here. The decision has to be
made on factors other than personalities.
> It seems Arwed gets to decide which path we take -- the Clean or the
> DETAILS (or entire spell) signature method (we really can't do a
> PGP-based scm at this point) if Thomas isn't going to pipe in. I'd like
> unanimity from Leads in every policy change such as this.
More information about the SM-Discuss