Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] verifying gpg keys

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Eric Sandall <eric AT sandall.us>
  • To: "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] verifying gpg keys
  • Date: Wed, 10 Aug 2005 22:18:14 -0700 (PDT)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, 10 Aug 2005, Jeremy Blosser (emrys) wrote:
On Aug 10, Eric Sandall [eric AT sandall.us] wrote:
<snip>
While this would be good for security reasons it may delay (and
possibly discourage developers with already little free time) spells
being updated due to the extra checks. It may also encourage gurus to
continue using md5sums as the 'lazy' way to update a package. While

Well, I don't see that users get a real benefit from developers using
guru GPG signatures for updates vs. checksums, if they aren't doing some
reasonable tarball validation to go with it. i.e. I don't see why it
matters if they take the 'lazy' way of just doing a checksum. (Note I'm
not really including md5sum, we'd want a better checksum, but those are
equally easy as md5 in the new setup.) Someone correct me if I'm missing
something there.

My point is that users trust us to do at least minimal checking of
tarballs and the signing is, in it's basic sense, to make sure the
user is using the same tarball the guru did when he/she worked on the
spell. GPG is nicer than md5sum because you don't need to uncompress
the tarball before verifying it's validity (e.g. OpenOffice ;)) and
it's a better algorithm, at least so far.

the following is not a valid reason, people are used to easily and
quickly updating packages and, for the users, seeing package updates
the same day (sometimes within minutes) of a version release. Granted,
some well-thought packagers already provide the necessary methods to
verify tarballs, but the majority do not.

Is it worth the (perceived?) extra overhead for the extra security?

Given that guru GPG signing already incurs some extra overhead, I think
it's worth adding a bit more to have the presence of the guru GPG signature
mean something objectively useful, yes. The world is full of security
checks that look impressive but are mostly applied as magical "pixie dust",
and in the end these tend to make things *less* secure because people
assume a level of security that isn't there in practice. Having developers
who don't really understand dual-key crypto or have the time to do a
minimum level of download integrity verification doing tarball signing just
because "hey, GPG is impressive, and we support it" is not good security
practice, IMO.

Correct, though I'd like GPG to be used for my points above alone, not
just the extra security it offers. You do have a good point on this,
though. :)

- -sandalle

- --
Eric Sandall | Source Mage GNU/Linux Developer
eric AT sandall.us | http://www.sourcemage.org/
http://eric.sandall.us/ | SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/ #196285 | http://www.shock.wsu.edu/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFC+t+bHXt9dKjv3WERApBdAJ958F8kHwYEHw3lfN4Ks4UvpOAtiACgiM9k
38lRhDPE9EGFx4HrIvchmyc=
=FJ/l
-----END PGP SIGNATURE-----




Archive powered by MHonArc 2.6.24.

Top of Page