Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Seth Alan Woolley <seth AT positivism.org>
  • To: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • Cc: SM-Discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Wed, 31 Aug 2005 11:16:08 -0700

On Wed, Aug 31, 2005 at 12:38:19PM -0400, Sergey A. Lipnevich wrote:
> Quoting Seth Alan Woolley <seth AT positivism.org>:
>
> >> >What circumstance would make acceptable a third-party source signing by
> >> >a member of our team?
> >>
> >> No, see my answers above and the "threat profile" message.
> >
> > No circumstances?
>
> I'm afraid none of the circumstances would involve directly associating my
> identity with any 3rd-party package, regardless of the disclaimer, so the
> answer is still negative, sorry.

It was indirect. More indirect than a simple hash. The problem case --
the out of context discovery of the source and your signature, is what
worried you. When the identity is forced to go through a disclaimer
(yes this is indirect) such as a click-wrap, you're still disturbed -- I
just don't know why.

How is it still direct to you?

> I tried to show that even from technical POV using GPG signatures (see all
> the
> assumptions in my other message) is not a good idea. I'd appreciate if you
> let
> me know, based on my threat analysis, why I should subject myself to the
> scrutiny of keys if in our case hashes provide the same threat protection
> with
> added convenience of not being personal?

I provided a technical means to remove the personal connection (but
retain non-repudiation) from your key. I still didn't see a direct
response to it.

Seth

--
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Quality Assurance Team Leader & Security Team: Source Mage GNU/linux
Linux so advanced, it may as well be magic http://www.sourcemage.org
Secretary Pacific Green Party of Oregon http://www.pacificgreens.org
Key id FDCEE733 = 5302 B414 64C4 6112 3454 E082 99F0 69DC FDCE E733

Attachment: pgpFebQnD5HEI.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page