Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Andrew \"ruskie\" Levstik" <ruskie AT mages.ath.cx>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors
  • Date: Thu, 8 Sep 2005 21:46:25 +0200

Ladislav Hagara wrote :

> >
> >
> >> Yep I like this idea. Why not always using a hash, and adding vendor
> >> signing when it's available ?
> >
> > Please re-read the thread and you'll know why.
>
>
> Eric, I have the same problem. I really don't understand "Why not always
> using a hash, and adding vendor
> signing when it's available ?". These threads are only very long but no
> discussions. Some of you don't want to listen. It was decided some time
> before this discussion. Some of you arranged it probably on irc or
> personally and we other have to just accommodate you.
>
> [---=| Quote block shrinked by t-prot: 6 lines snipped |=---]
> >> users.
> >
> > We're not banning the better technological approach, but, after the
> > poll I conducted, we are going to continue to support hashsums for the
> > foreseeable future with `gpg --print-md`.
>
> Yea, according to several of you it is better technological approach.
> But I know developers who don't agree with it.
> What it the result of that poll? Who agree? Who don't agree?
> It is the same as our leaders polls. I know only "and winner is ...".
> Personally I would like to know who voted who. What was the difference.
> I would like to have this process more transparent.
>
> >> # cast xyz
> >> Checking xyz's developers gpg signing ... OK.
> >> Checking Source Mage hash ... OK
> >> ...
> >
> > Why not just one?
>
> It was written. As you wrote "Please re-read the thread and you'll know
> why."
> We know nothing about application developer's signing policy. Their web
> site can be cracker, their private key can be stolen.
> Lets go to download new repackage of xyz with good signature with "rm
> -rf /*". Our hash can help to prevent it.
>
> >> What is the result of our discussion? What is the result of GPG signing
> >> poll?
> >
> > Whoops, I responded as I read, sorry. Answer is above. ;)
>
> Yea, it is very transparent. Thank you.
>
> > Short answer: We will continue to support hashsums as well as GPG.
>
> How long? To next accidental irc meeting?
>
> Some last changes are quite annoying for me. Changes in perforce
> (subject and sender, your sweet diffs). This "discussion" about gpg
> signing. Refusing of Benoit's work. Do you really think
> http://www.sourcemage.org/developers looks/is better than
> http://wiki.sourcemage.org/index.php?page=The+Source+Mage+Developers ?
>
> On the other side, I can only thank you all for developing this great
> distro.
>
> --
> Ladislav Hagara
> Source Mage GNU/Linux Developer
> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss
>
>

Can we put this thread to it's grave now? Please????
It served it's purpose... Start a new one to discuss recent
changes and so on...

--
Andrew "ruskie" Levstik
Source Mage GNU/Linux Games grimoire guru

Key id = 9A5117F8
Key fingerprint = 6731 FEF2 99A8 4672 5962 69AB 3DAF DA67 9A51 17F8





Archive powered by MHonArc 2.6.24.

Top of Page