Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Andrew <afrayedknot AT thefrayedknot.armory.com>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Fri, 26 Aug 2005 09:54:06 -0700

> I'm not really happy with let me sign someone else's stuff and hope it
> doesn't
> to anything nasty. *I* DO NOT TRUST ANYBODY so much.

You signature doesnt imply that, it implies that the source someone else
gets is the same one you got when you updated the spell. Thats it.

strength != trust

We dont do security audits, we trust the vendors not to do nasty stuff.
That said theres the same amount of 'trust' from putting the MD5 in the
spell as signing a tarball. Trust is not the added value here, *strength*
(in terms of stronger hash values) is the added value. A gpg signature
is harder to break than a simple hash code.

-Andrew

--
__________________________________________________________________________
|Andrew D. Stitt | astitt at sourcemage.org |
|irc: afrayedknot | afrayedknot at t.armory.com |
|aim: thefrayedknot or iteratorplusplus | acedit at armory.com |
|Sorcery Team Lead | ftp://t.armory.com/ |
--------------------------------------------------------------------------




Archive powered by MHonArc 2.6.24.

Top of Page