Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Mon, 29 Aug 2005 16:03:35 -0500

I'm sure most people are really tired of this thread before it even
started, so I really want to bring my responses to a close. If you have
things you think there is value in continuing to discuss, I'm willing to
keep talking, but otherwise we should probably agree to end this soon and
see if other project members have input.

On Aug 29, Sergey A. Lipnevich [sergey AT optimaltec.com] wrote:
> Quoting "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>:
>
> >> What you're saying is that signing something doesn't mean anything
> >> except that it was signed by <person>. Why then your signature on a
> >> blank piece of paper different from a signature on a contract?
> >
> > Because of the legally agreed context of the contract. Contracts and
> > other
> > legal documents usually make this explicit, with language like "we, the
> > undersigned parties...", and also an explicit list in the terms of the
> > contact of who is involved. That list combined with the non-repudiation
> > of
>
> Very nice. So you *are* implying that a contract must be read, right? What
> happens if it's too long to read or written in a dialect you are not
> familiar
> with?

"Must be read" before signing it, I assume? Only if the context of the
signature is that by signing you have read it (note I didn't say agree with
it). There are various types of signatures on contracts: I have received
this (but haven't necessarily read it), I have read it (but don't
necessarily agree with it), I have read it and will be bound by its terms.

If a contract is not something you can read and if the signature line says
that by signing it you are committing to something more than receipt, or if
you can't read it enough to even tell what your signature means, then you'd
be foolish to sign it. But that's a lot of ifs, and they're all dependent
on a context you're saying doesn't exist.

> > the signature is what binds the signee to the terms of the contact, not
> > the
> > signature by itself. I can go out and sign my name on whatever contracts
> > I
> > want but if I'm not a listed party to the contact it doesn't really mean
> > anything beyond that I wrote my name on a piece of paper.
>
> My point exactly! So why do that? Why sign your name on a piece of paper if
> it
> *doesn't mean anything*? That's what you do when you sign a tarball having
> no
> idea what's inside.

No, it really is not your point. My point is that the signature means what
the context of the contract+signature means. Yours is that the signature
always means you've read everything, accept responsibility for it, and I
don't know what else. By my point, you can sign a contract and have no
responsibility incurred, which is what I said above. By your point this
would not even be possible.

As for why someone would sign something in this context, I don't know, I
was speaking rhetorically. There are valid reasons though... a notary
signing a contract is meaning something completely different by the
signature than the parties to the contract mean by their signature. A
clerk signing or stamping a contract to confirm receipt and for filing
purposes means yet another thing. Neither the notary nor the clerk are
bound by the terms of the contract or even expected to have read one word
of it.

Attachment: pgptbywGjkwyL.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page