Public SourceMage Discussion List

[David Kowis <dkowis AT shlrm.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Sergey A. Lipnevich wrote:
> Quoting David Kowis <dkowis AT shlrm.org>:
> 
> 
>>-----BEGIN PGP SIGNED MESSAGE-----
>>Hash: SHA1
>>
>>Sergey A. Lipnevich wrote:
>>
>>>Quoting "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>:
>>>>content.  The three they list are authenticity, integrity, and
>>>>non-repudiation.  Non-repudiation is the closest to the kind of single
>>>>meaning you're trying to attach to signing something, but again, a digital
>>>>signature only functions in that regard to establish that the signee was
>>>>the one that signed something.  What the act of signing meant and what 
>>>>they
>>>
>>>What you're saying is that signing something doesn't mean anything 
>>>except that
>>>it was signed by <person>. Why then your signature on a blank piece of 
>>>paper
>>>different from a signature on a contract?
>>
>>I'm going to have to agree with Jeremy on this. A signature can be 
>>defined to mean anything the "contract" defines it to be. For example:
> 
> 
> But you have to read this contract, not just say that there are no spelling
> errors in it. Why do I feel like I'm bagning against the wall here? Why do I
> never get a straight answer to the question "would you sign something you
> didn't read?"

Damnit man!
The contract is not the source code! The contract is the little disclamer 
that we (Source Mage) came up with that says,

"We are signing this to verify that it's the same one we used when we created 
the spell."
NOT FOR THE SECURITY OF THE SOURCE CODE.

This is like the 7th time such things have been told to you.

> 
>>When I got a speeding ticket in the past, I had to sign it. It was 
>>not an admission of guilt, just an agreement to do something about the
> 
> 
> Right, you accepted the responsibility. You'd be arrested if you refused to
> sign.
And no I didn't accept any responsibility. I didn't not admit guilt. I agreed 
to go to court. The analogy was:
I'm signing this tarball, not to validate that the source will not eat your 
computer, but that it's the same source I used.

> 
> 
>>ticket. And that's it. A gpg signature of the source tarball is 
>>perfectly acceptable, since we've defined our signature to verify 
>>that if
> 
> Acceptable, yes, thank you! But not mandatory.
It's mandatory if the majority of Source Mage decides it should be mandatory, 
just like md5 hashes are now.

> 
> 
>>There's no specific definition as to what a signature means. That's 
>>why you're told (at least, I was) to always read anything you've got 
>>to
>>sign so that you know what you're agreeing to when you sign it. We've
> 
> Exactly! And I can't read the source, there's too much of it. How can I 
> sign it
> then? If you can do that, please go ahead, but don't force me along this 
> path.
Copy/paste
The contract is not the source code! The contract is the little disclamer 
that we (Source Mage) came up with that says,

"We are signing this to verify that it's the same one we used when we created 
the spell."
NOT FOR THE SECURITY OF THE SOURCE CODE.
> 
> 
>>(by we I mean the Sourcemage team) has made it quite clear that we're
>>not verifying that the source won't kill your mom, but that it's the 
>>same source we got when we built our spell.
> 
> 
> Then don't use a signature.
once again, copy/paste
The contract is not the source code! The contract is the little disclamer 
that we (Source Mage) came up with that says,

"We are signing this to verify that it's the same one we used when we created 
the spell."
NOT FOR THE SECURITY OF THE SOURCE CODE.

> 
>>I see nothing wrong with using gpg signatures for source verification.
> 
> 
> Neither do I. I see a lot of things wrong with signing something I 
> couldn't read
> in advance. Did I say I don't aim to stop anyone from signing anything, I 
> just
> don't want to participate in this myself or see anyone else forced into it
> against their will?
more copy/paste
The contract is not the source code! The contract is the little disclamer 
that we (Source Mage) came up with that says,

"We are signing this to verify that it's the same one we used when we created 
the spell."
NOT FOR THE SECURITY OF THE SOURCE CODE.
> 
> 
>>I think that one can never have enough security. especially when it
> 
> 
> Signing something you didn't read can only take security away from you, not
> provide more of it.
Copy/paste again
The contract is not the source code! The contract is the little disclamer 
that we (Source Mage) came up with that says,

"We are signing this to verify that it's the same one we used when we created 
the spell."
NOT FOR THE SECURITY OF THE SOURCE CODE.

> 
> 
>>doesn't affect anything. There's a script under development, similar to
>>md5unpack to make gpg signing of source easy.
> 
> 
> Right. What about a script that unbinds you from a signed contract in 
> real life?
> Did I ever say I don't want to do it because it's difficult? I don't think 
> so.
> 
Fair enough.
> 
>>Acutally the easiest way to send a file to someone would be to use 
>>GPG. Sign it and then the receiver simply verifies the signature.
> 
> 
> If you have a verified key, yes. If your key is lost or stolen, no. 
> Hashes don't
> impose such limits.
> 
What? If your key is lost or stolen, you invalidate your Public key on the 
key servers and use a new one. If the hash is compromised, then
what? There's no way, other than mass Email, to let everyone know that the 
hash is bogus.
> 
>>like you just described are precisely what Public Key Infrastructure 
>>is for. Publishing a hash value on a widely known server is flawed. If
> 
> 
> PKI and GPG are two very different things.
> How is it "flawed" from the *integrity* point of view? I agree that it 
> doesn't
> provide *security*, I said that in item #1 of my original email.
If the hash is compromised, there's no way for the user to know if the hash 
is good. No way at all.

PKI and GPG are not two different things. gnupg is an implementation of 
Public Key Infrastructure. Public Key Infrastructure is more than
just SSL or TLS, it's a methodology that pgp/gpg fullfills.

http://www.pki-page.org/
more info on pki
http://www.pkilaw.com/9902issp-Book/index.htm

> 
> 
>>that signature is compromised, how does one verify it? with another 
>>hash on another server? This can chain off into oblivion.
>>IMO, ISO publishers did this because gpg wasn't widely available.
> 
> Regardless of why they do it, it works: integrity can be verified and is
> verified on a computer near you. No keys involved.
Just because it's been done, doesn't mean there's not a better way to do it. 
Isn't that why we're working on Source Mage to begin with? If
we all had such a philosophy, we'd all be using Windows. It's there, and it 
works (mostly.)
> 
> 
>>>If it's my personal key, no. It doesn't matter what it says. If it's 
>>>somehow
>>>shared (I don't know if it's possible with GPG), than see my question above
>>>about the plan to manage it.
>>
>>Sub-keys of a master key. I think anyway. Your specific "Source 
>>signing key" would be signed by the master "SGML SOOPER SOURCE key".
>>
>>I've contributed my sanity to this madness.
>>or is it my madness to this sanity...?
> 
> If we can agree on not making GPG signatures mandatory, we can stop 
> right away.
> I'm not interested in preaching on this subject, I just want my freedom of
> choice back.
You cannot always expect a development team to provide all the options. You 
may not be able to choose to use md5 any more. It's as simple as
that. If the consensus is that Source Mage would benefit from GPG signatures, 
then that's the way we go. GPG has many more benefits than md5
does. You can sign groups of files; eliminating the array of required 
signatures to name one.

- --
David Kowis

ISO Team Lead - www.sourcemage.org
SourceMage GNU/Linux

Progress isn't made by early risers. It's made by lazy men trying to find 
easier ways to do something.
  - Robert Heinlein

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (MingW32)

iD8DBQFDE3PQtgErhgxHMHsRAgEGAJwN2zULNEjsVSg5eOuf34TpvUmG2ACfSkoH
a+wydW/e4TpaGF12IgDjgfU=
=G1Ha
-----END PGP SIGNATURE-----