Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • To: Seth Alan Woolley <seth AT positivism.org>
  • Cc: SM-Discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Wed, 31 Aug 2005 00:07:56 -0400

Quoting Seth Alan Woolley <seth AT positivism.org>:

It's a good thing you're reading standards, but let me ask about your
entitlements. Disclosure: I don't have any security-related
certifications. Do you? If we're just two guys argueing about merits
of the standard, then I'm afraid we read remain at a disagreement.

Did you just admit that you'd take the decision of somebody who is paper
certified over your own?

No, I'm trying to politely say that you should prepend your explanation of
stsndards with "IMO." I just did.

I am also not confusing things as you suggested. I am trying to
explain them to those who are willing to listen. I am also trying to
have my choice back.

I hope the suggestion above will be a good compromise?

No, because I am still the originator of the tarball if I sign it. I'm not going
to reply to the whole piece you had above. Suffice it to say that it reinforces
my point. Words like "authenticity" and "identity" run through your citings of
FIPS-186. I don't want people coming to *me* to check authenticity of
xyz-1.2.3.tar.bz2, and I don't want them to associate my identity with it. They
have "tar tjf" to check for elementary breakage and a hashsum to check for
integrity. I believe that's enough. Moreover, I believe I will do injustice to
them *and* myself by giving them more.

And just so I know, do you keep in mind that I am not opposing the use of
signatures? I am opposing the mandatory use.

Sergey.





Archive powered by MHonArc 2.6.24.

Top of Page