Public SourceMage Discussion List

[Andrew <afrayedknot AT thefrayedknot.armory.com>]

> I'm not really happy with let me sign someone else's stuff and hope it 
> doesn't
> to anything nasty. *I* DO NOT TRUST ANYBODY so much.

You signature doesnt imply that, it implies that the source someone else
gets is the same one you got when you updated the spell. Thats it.

strength != trust 

We dont do security audits, we trust the vendors not to do nasty stuff.
That said theres the same amount of 'trust' from putting the MD5 in the
spell as signing a tarball. Trust is not the added value here, *strength*
(in terms of stronger hash values) is the added value. A gpg signature
is harder to break than a simple hash code.

-Andrew

-- 
__________________________________________________________________________
|Andrew D. Stitt                           | astitt at sourcemage.org    |
|irc: afrayedknot                          | afrayedknot at t.armory.com |
|aim: thefrayedknot or iteratorplusplus    | acedit at armory.com        |
|Sorcery Team Lead                         | ftp://t.armory.com/         |
--------------------------------------------------------------------------