Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Mon, 29 Aug 2005 17:17:59 -0400

Quoting David Kowis <dkowis AT shlrm.org>:

But you have to read this contract, not just say that there are no spelling
errors in it. Why do I feel like I'm bagning against the wall here? Why do I
never get a straight answer to the question "would you sign something you
didn't read?"

Damnit man!
The contract is not the source code! The contract is the little disclamer that we (Source Mage) came up with that says,

It's like saying: "In this part of the country we sign things simply because
they're typed cleanly on white sheets of paper. In other parts of the country,
they do it for different reasons, but we don't care." I already said that I
can't accept that because others may not be aware that we've invented new
meaning for an old process.

"We are signing this to verify that it's the same one we used when we created the spell."
NOT FOR THE SECURITY OF THE SOURCE CODE.

See above.

This is like the 7th time such things have been told to you.

And I responded faithfully to that: it is wrong to change meaning of things. How
can I explain that any differently?

When I got a speeding ticket in the past, I had to sign it. It was
not an admission of guilt, just an agreement to do something about the


Right, you accepted the responsibility. You'd be arrested if you refused to
sign.
And no I didn't accept any responsibility. I didn't not admit guilt. I agreed to go to court. The analogy was:
I'm signing this tarball, not to validate that the source will not eat your computer, but that it's the same source I used.

You didn't read the tarball before signing. That's a problem for me: I can't do
that.

Acceptable, yes, thank you! But not mandatory.
It's mandatory if the majority of Source Mage decides it should be mandatory, just like md5 hashes are now.

Well, you've noticed there is me and a few others who object.

Exactly! And I can't read the source, there's too much of it. How can I
sign it
then? If you can do that, please go ahead, but don't force me along this path.
Copy/paste
The contract is not the source code! The contract is the little disclamer that we (Source Mage) came up with that says,

Please see above: I don't agree with this contract. And please read item #4 of
the original email.

Then don't use a signature.
once again, copy/paste
The contract is not the source code! The contract is the little disclamer that we (Source Mage) came up with that says,

Very well then, see above.



I think that one can never have enough security. especially when it


Signing something you didn't read can only take security away from you, not
provide more of it.
Copy/paste again
The contract is not the source code! The contract is the little disclamer that we (Source Mage) came up with that says,

Do it again and I'll stop talking to you. I have no problem signing this
statement, because you're being irrespectful.

Right. What about a script that unbinds you from a signed contract in
real life?
Did I ever say I don't want to do it because it's difficult? I don't think so.

Fair enough.

Now we're talking again.

on the key servers and use a new one. If the hash is compromised, then
what? There's no way, other than mass Email, to let everyone know that the hash is bogus.

Publish a new hash, we've seen it happen many times. What if a tarball is
compromised because the key is stolen and the owner doesn't know about it?

If the hash is compromised, there's no way for the user to know if the hash is good. No way at all.

We have a good hash value in our repo, remember? Users will know the new tarball
is different.

PKI and GPG are not two different things. gnupg is an implementation of Public Key Infrastructure. Public Key Infrastructure is more than
just SSL or TLS, it's a methodology that pgp/gpg fullfills.

Maybe the difference between key hierarchy and keyring rings a bell? PKI as we
know it depends on certificate authorities, GPG/PGP does not.

that signature is compromised, how does one verify it? with another
hash on another server? This can chain off into oblivion.
IMO, ISO publishers did this because gpg wasn't widely available.

Regardless of why they do it, it works: integrity can be verified and is
verified on a computer near you. No keys involved.
Just because it's been done, doesn't mean there's not a better way to do it. Isn't that why we're working on Source Mage to begin with? If

If this better way involves putting my name on things I don't associate with and
don't vouch for, it's not a better way.

we all had such a philosophy, we'd all be using Windows. It's there, and it works (mostly.)

If Windows is adequate for some people, they use it. If Linux is, they use it as
well. Just because in your eyes Linux is better, doesn't mean Windows cannot do
the job. Depends on the job, I agree. But, hashes are adequate means of
integrity checking, and I don't think anybody, including you, argued against
that directly. It's difficult to argue because GPG, PKI, etc use hashes as a
means of verifying integrity, and then sign hashes with keys to verify
authorship.

If we can agree on not making GPG signatures mandatory, we can stop
right away.
I'm not interested in preaching on this subject, I just want my freedom of
choice back.
You cannot always expect a development team to provide all the options. You may not be able to choose to use md5 any more. It's as simple as
that. If the consensus is that Source Mage would benefit from GPG signatures, then that's the way we go. GPG has many more benefits than md5
does. You can sign groups of files; eliminating the array of required signatures to name one.

I can't argue with consensus, but I would stop contributing if this opressive
decision forces me to act against my will. I regard this decision as not just
inconvenience, but infringement of my rights. Let me repeat: I don't sign
things I don't read. I am not playing games for the sake of instilling a false
sense of security in our users or ourselves. I think SMGL is doing a great job
already providing hash verification and validation of authors' signatures, and
I am convinced that doing more than that would be not only excessive, but
misleading.

Sergey.





Archive powered by MHonArc 2.6.24.

Top of Page