Public SourceMage Discussion List

[dave AT sourcemage.org]

On Mon, Aug 29, 2005 at 04:39:20PM -0400, Sergey A. Lipnevich wrote:
> Quoting "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>:
> 
> >> What you're saying is that signing something doesn't mean anything 
> >> except that
> >> it was signed by <person>. Why then your signature on a blank piece of 
> >> paper
> >> different from a signature on a contract?
> >
> > Because of the legally agreed context of the contract.  Contracts and 
> > other
> > legal documents usually make this explicit, with language like "we, the
> > undersigned parties...", and also an explicit list in the terms of the
> > contact of who is involved.  That list combined with the non-repudiation 
> > of
> 
> Very nice. So you *are* implying that a contract must be read, right? What
> happens if it's too long to read or written in a dialect you are not 
> familiar
> with?
> 
> > the signature is what binds the signee to the terms of the contact, not 
> > the
> > signature by itself.  I can go out and sign my name on whatever contracts 
> > I
> > want but if I'm not a listed party to the contact it doesn't really mean
> > anything beyond that I wrote my name on a piece of paper.
> 
> My point exactly! So why do that? Why sign your name on a piece of paper if 
> it
> *doesn't mean anything*? That's what you do when you sign a tarball having 
> no
> idea what's inside.
> 
> > Even things like mailing invoices usually contain language to make it 
> > clear
> > if you're signing that you just received a box vs. have inspected and
> > agreed that the contents match the invoice.  And even that doesn't say you
> 
> That's why I said that doing this is akin to signing a contract simply 
> because
> it has no grammar or spelling errors, without understanding the meaning. If 
> I
> have a reasonable way to make sure the contract says the right thing, I'd 
> sign
> it. But what if I don't? I can's sign such a contract.
> 
> > But my original statement there has nothing to do with what is easiest.  I
> > said that the primary use and meaning of a cryptographic signature is
> > transmission integrity verification.  That has nothing to do with if there
> > are other methods to accomplish the same thing.
> 
> We're in complete disagreement about this one. I was countering your 
> statement,
> not making provisions for what's easier. My point is that there are adequate
> ways to ensure integrity without involving non-repudiation and authenticity.
> 
> > Well if it's a shared key than "framing" means nothing anyway, because
> > there's no longer non-repudiation at the individual level.  And all of
> > these things already assume our own developers are trusted; if someone
> > wants to be malicious there are much easier things to attack.  I believe
> > those with the access already share keys for the tarballs we distribute.
> 
> Let me give you an example. A spell contains a line:
> $EDITOR $SCRIPT
> What happens when EDITOR is not set? Right, the script runs. If this 
> script does
> rm -fr * (no leading slash) but is run from root, chaos begins. If I 
> wrote this
> piece of code and you signed it, who's responsible? My point is, "framing" 
> can
> be unintentional.
> 
> So, am I getting my freedom back or I have to sign everything in sight with 
> my
> name and hope it doesn't destroy your PC? As I said, I'm not asking for
> agreement, I'm asking to leave my options open.
> 
> Sergey.

I understand that you might have reservations using a personal
signature. Signing your name is serious business, and not to be done
lightly. However you are making a logical error in assuming the
signature itself has some inherent meaning other than repudiating your
agreement to the stated terms. 

Although you will be providing your signature with the tarball, you are not
signing the tarball. You are signing this:

http://www.sourcemage.org/security-source_integrity_checking_standards

--dave.

Attachment: pgpAgClD7bn_V.pgp
Description: PGP signature