Public SourceMage Discussion List

[David Kowis <dkowis AT shlrm.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Sergey A. Lipnevich wrote:
> Quoting Eric Sandall <eric AT sandall.us>:
> 
> Did I make myself clear on why I don't care about what's written on our 
> Web site
> about signatures, and nobody else does? I hope I did. Please understand that
> *this* point is the beef of my argument. I tried to express it as item 
> #4 of my
> original email, which was not understood well.

How do you know that no one else uses signatures except through your 
definition?
What does "getting smashed" mean to you? perhaps not the same thing to me. 
But we can come to a conclusion on the definiton of "getting
smashed" by telling each other what we mean by saying it. That way you know 
what I mean when I'm saying "I'm getting smashed." and I can
understand what you mean when you say, "help, I'm getting smashed." However, 
if there was only one definition, getting smashed could be
significantly less fun.

> Finally, I'm saying, and we agree on that at least with you Eric, that hash
> values do allow for detection of integrity problems. I argue that they are
> sufficient, and there's no reason to go further. If package authors sign 
> their
> packages, we support GPG verification, otherwise all bets are off. But 
> please
> understand that this is just a secondary reason of why I can't sign a 
> tarball.
> If there were no such thing as hash value, I couldn't sign an alien tarball
> anyway.
Well, we are arguing that, although they may be sufficient, we want to use a 
different, better method.

> 
> Finally, Seth here is telling us that signatures do not mean security.
> Regardless of whether I agree or disagree with this, please understand that
> signatures are perceived as means to provide additional layer of... what?
> correct, *security*! Why do I think so? Let me put our friend Andrew on the
> spot (I'm sorry Andrew, you made it too easy with your email to make my 
> point).
> He recently wrote this:
> https://lists.ibiblio.org/sympa/arc/sm-discuss/2005-August/011907.html
> 
> Citing it: "This is part of my new security policy I'm implementing for 
> myself.
> This key expires end of the year and I will issue a new one then."
Yes, to insure that the data transmission is untampered and unaltered. Not to 
ensure that the data in that email isn't virus ridden and
going to delete your mom or call your data a whore.

> 
> So, people do perceive digital keys as a means of security. Not the 
> only means,
> of course, but definitely an important one. In the U.S., you can sign 
> your name
> now with the help of digital signature. Not GPG I think. Nevertheless, in 
> the
> public eye digital signature is very much alike the real deal. You can't try
> and change this meaning just by posting a disclaimer on the site.
But people read what the signature is for. If the disclaimer of the 
undersigned says "I, the undersigned, have not read this and I don't
really care." then that's all the signature means. NOTHING ELSE. NOT that 
he's read anything, ONLY what's mentioned in the statement, NOT
the entire document. This is the most times I've ever explained anything to 
anyone. I don't understand how you cannot understand what we're
saying. I don't think I, or anyone else, has been unclear in describing to 
you how we're going to do this.

> 
> The question is, are we clear now on what I am objecting to?
You're objecting to common definition. You will not accept any other 
definition of what a signature is for. You're the only one disagreeing
with us all on the definition of a signature. I've a strong feeling that 
we're going to move forward with replacing the hashes with gnupg
signatures. This has been explained to you countless times, and honestly, I 
don't value your input on it any more. You've claimed the same
thing every single email and we've countered it every single time, getting 
more descriptive every time. I've made my decision, if I get a
cast in the vote (if there even is a vote,) I'll be voting for GNUpg 
signatures for download verification. I hope you can accept what we're
going to do, or peacefully move on.


- --
David Kowis

ISO Team Lead - www.sourcemage.org
SourceMage GNU/Linux

Progress isn't made by early risers. It's made by lazy men trying to find 
easier ways to do something.
  - Robert Heinlein

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (MingW32)

iD8DBQFDFLG4tgErhgxHMHsRAosJAJ9ReNV5x6yZo/GvNDN/Yq/yhKWVmgCgh8M1
kLHdUOYNAV80agIkmQl9NY4=
=oASU
-----END PGP SIGNATURE-----