Public SourceMage Discussion List

["Sergey A. Lipnevich" <sergey AT optimaltec.com>]

Quoting Seth Alan Woolley <seth AT positivism.org>:

> DRAFT, although this is one case where we're actually moving on it
> quickly, so it's more of a last call for objections.

So here goes: I object.

1. Hash collision is not a problem when it comes to source tarballs, so please
don't use it as a reason to switch to signatures. We could've as easily hashed
them with CRC32 or with 10K-bit hash. *Either* way provides *no* security.
2. There's no way I can sign a bunch of code I didn't read through and
understand. It's an impossible task in a distribution, so it's shorter to say
that I can't sign a bunch of code, period.
3. Let's be frank Seth, tarballs that you, or anyone else besides the authors,
signed are as *insecure* as they were before you did that. It didn't format
your hard drive? Good for you. Maybe it's designed to format only *mine*. Or
the drive of the guy who works for CIA ot Chinese government. You don't know
that.
4. Combination of #2 and #3 leads me to believe that we do not provide *any*
additional security over unsigned tarballs, so let's focus on *integrity*.
Integrity is *perfectly* verified by the hash. Stronger hash if necessary, but
nevertheless a hash. Non-personified piece of information.
5. What people keep saying on the list amounts to: let's call it blue even
though it's black. Meaning, let's call GPG signature a means to verify
integrity even though it's a means to verify source and integrity. I don't buy
that.

Don't get me wrong, I believe that PGP and GPG are one of the most overlooked
technologies of the present time, in the light of PKI having so many 
unresolved
and abandoned issues. So, I support use of GPG signatures, but for the correct
purpose. Verifying integrity of the source tarballs is not a sufficient
purpose.

Sergey.