Public SourceMage Discussion List

["Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>]

On Aug 30, Sergey A. Lipnevich [sergey AT optimaltec.com] wrote:
> You're now trying to mislead everyone even further by calling a hash value a
> signature. It's the same tactics you guys are trying to use to redefine the
> purpose of signature to mean something else.

It is true that a hash and a signature have different properties.  Raw
hashes lack authenticity and non-repudiation.  However, this is not a
problem for us given the proper definition and understanding of what those
things are.  Our definitions of these things are correct.  You may choose
to hold the opinion that they are not, but you are as technically incorrect
as you would be if you claimed the square root of 4 is 8.  You may claim
you are speaking about public opinion instead of technical definitions, but
as I spelled out in my last mail, most open source projects disclaim all
warranty, and people are quite aware of and used to this idea.  If you
missed it somewhere you are quite definitely in the minority.

> At least try to answer one question: find me a major OSS project that has
> a policy disclaiming authenticity and non-repudiation of the code signed
> by their GPG signatures, and claiming only integrity must be verified.
> You and Jeremy and others keep ignoring the questions I ask and try to
> find nonexistent gaps in my logic, and that's not how I like the
> discussions to be held.

If you're going to include my name in a statement like that, I'd like you
to provide one question you've asked me that I've ignored so that I can
address it.  To the "find me a..." question above, see my last mail.  Then
find me one major OSS project that does *not* disclaim any and all
warantees of what their source code will do to your system when installed.

Attachment: pgpFmnYyhnpZt.pgp
Description: PGP signature