sm-discuss AT lists.ibiblio.org
Subject: Public SourceMage Discussion List
List archive
Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
- From: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
- To: sm-discuss AT lists.ibiblio.org
- Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
- Date: Mon, 29 Aug 2005 17:17:59 -0400
Quoting David Kowis <dkowis AT shlrm.org>:
But you have to read this contract, not just say that there are no spelling
errors in it. Why do I feel like I'm bagning against the wall here? Why do I
never get a straight answer to the question "would you sign something you
didn't read?"
Damnit man!
The contract is not the source code! The contract is the little disclamer that we (Source Mage) came up with that says,
It's like saying: "In this part of the country we sign things simply because
they're typed cleanly on white sheets of paper. In other parts of the country,
they do it for different reasons, but we don't care." I already said that I
can't accept that because others may not be aware that we've invented new
meaning for an old process.
"We are signing this to verify that it's the same one we used when we created the spell."
NOT FOR THE SECURITY OF THE SOURCE CODE.
See above.
This is like the 7th time such things have been told to you.
And I responded faithfully to that: it is wrong to change meaning of things. How
can I explain that any differently?
And no I didn't accept any responsibility. I didn't not admit guilt. I agreed to go to court. The analogy was:When I got a speeding ticket in the past, I had to sign it. It was
not an admission of guilt, just an agreement to do something about the
Right, you accepted the responsibility. You'd be arrested if you refused to
sign.
I'm signing this tarball, not to validate that the source will not eat your computer, but that it's the same source I used.
You didn't read the tarball before signing. That's a problem for me: I can't do
that.
Acceptable, yes, thank you! But not mandatory.It's mandatory if the majority of Source Mage decides it should be mandatory, just like md5 hashes are now.
Well, you've noticed there is me and a few others who object.
Exactly! And I can't read the source, there's too much of it. How can ICopy/paste
sign it
then? If you can do that, please go ahead, but don't force me along this path.
The contract is not the source code! The contract is the little disclamer that we (Source Mage) came up with that says,
Please see above: I don't agree with this contract. And please read item #4 of
the original email.
Then don't use a signature.once again, copy/paste
The contract is not the source code! The contract is the little disclamer that we (Source Mage) came up with that says,
Very well then, see above.
Copy/paste again
I think that one can never have enough security. especially when it
Signing something you didn't read can only take security away from you, not
provide more of it.
The contract is not the source code! The contract is the little disclamer that we (Source Mage) came up with that says,
Do it again and I'll stop talking to you. I have no problem signing this
statement, because you're being irrespectful.
Right. What about a script that unbinds you from a signed contract inFair enough.
real life?
Did I ever say I don't want to do it because it's difficult? I don't think so.
Now we're talking again.
on the key servers and use a new one. If the hash is compromised, then
what? There's no way, other than mass Email, to let everyone know that the hash is bogus.
Publish a new hash, we've seen it happen many times. What if a tarball is
compromised because the key is stolen and the owner doesn't know about it?
If the hash is compromised, there's no way for the user to know if the hash is good. No way at all.
We have a good hash value in our repo, remember? Users will know the new tarball
is different.
PKI and GPG are not two different things. gnupg is an implementation of Public Key Infrastructure. Public Key Infrastructure is more than
just SSL or TLS, it's a methodology that pgp/gpg fullfills.
Maybe the difference between key hierarchy and keyring rings a bell? PKI as we
know it depends on certificate authorities, GPG/PGP does not.
Just because it's been done, doesn't mean there's not a better way to do it. Isn't that why we're working on Source Mage to begin with? Ifthat signature is compromised, how does one verify it? with another
hash on another server? This can chain off into oblivion.
IMO, ISO publishers did this because gpg wasn't widely available.
Regardless of why they do it, it works: integrity can be verified and is
verified on a computer near you. No keys involved.
If this better way involves putting my name on things I don't associate with and
don't vouch for, it's not a better way.
we all had such a philosophy, we'd all be using Windows. It's there, and it works (mostly.)
If Windows is adequate for some people, they use it. If Linux is, they use it as
well. Just because in your eyes Linux is better, doesn't mean Windows cannot do
the job. Depends on the job, I agree. But, hashes are adequate means of
integrity checking, and I don't think anybody, including you, argued against
that directly. It's difficult to argue because GPG, PKI, etc use hashes as a
means of verifying integrity, and then sign hashes with keys to verify
authorship.
If we can agree on not making GPG signatures mandatory, we can stopYou cannot always expect a development team to provide all the options. You may not be able to choose to use md5 any more. It's as simple as
right away.
I'm not interested in preaching on this subject, I just want my freedom of
choice back.
that. If the consensus is that Source Mage would benefit from GPG signatures, then that's the way we go. GPG has many more benefits than md5
does. You can sign groups of files; eliminating the array of required signatures to name one.
I can't argue with consensus, but I would stop contributing if this opressive
decision forces me to act against my will. I regard this decision as not just
inconvenience, but infringement of my rights. Let me repeat: I don't sign
things I don't read. I am not playing games for the sake of instilling a false
sense of security in our users or ourselves. I think SMGL is doing a great job
already providing hash verification and validation of authors' signatures, and
I am convinced that doing more than that would be not only excessive, but
misleading.
Sergey.
-
Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
, (continued)
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Andrew "ruskie" Levstik, 08/29/2005
-
Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support,
Eric Sandall, 08/29/2005
-
Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support,
Sergey A. Lipnevich, 08/29/2005
-
Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support,
Jeremy Blosser (emrys), 08/29/2005
-
Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support,
Sergey A. Lipnevich, 08/29/2005
-
Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support,
Jeremy Blosser (emrys), 08/29/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Sergey A. Lipnevich, 08/29/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, David Kowis, 08/29/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Sergey A. Lipnevich, 08/29/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, David Kowis, 08/29/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Sergey A. Lipnevich, 08/29/2005
-
Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support,
Jeremy Blosser (emrys), 08/29/2005
-
Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support,
Sergey A. Lipnevich, 08/29/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Jeremy Blosser (emrys), 08/29/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Sergey A. Lipnevich, 08/29/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Jeremy Blosser (emrys), 08/29/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Sergey A. Lipnevich, 08/29/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Jeremy Blosser (emrys), 08/29/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Mads Laursen, 08/29/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Jeremy Blosser (emrys), 08/30/2005
-
Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support,
Jeremy Blosser (emrys), 08/29/2005
-
Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support,
Sergey A. Lipnevich, 08/29/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Eric Sandall, 08/30/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Jeremy Blosser (emrys), 08/30/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, dave, 08/29/2005
Archive powered by MHonArc 2.6.24.