Public SourceMage Discussion List

[Seth Alan Woolley <seth AT positivism.org>]

On Tue, Aug 30, 2005 at 04:15:58PM -0400, Sergey A. Lipnevich wrote:
> Quoting David Kowis <dkowis AT shlrm.org>:
> 
> >>> definition of what a signature is for. You're the only one disagreeing
> >>> with us all on the definition of a signature. I've a strong feeling
> >>> that we're going to move forward with replacing the hashes with gnupg
> >>
> >>
> >> Is that the final consensus that hashes are not going to be supported?
> >>
> > I cannot speak for the entirety of the Source Mage community, but 
> > I've no problems with it, and no one else has voiced disagreement.
> 
> I believe it's time to answer that question. Who's authorized to seal the
> decision, sorcery lead or the project lead?

There's still time to discuss.  Personally, I wouldn't be content with 
removing a feature without consensus of all team leads that are effected 
(sorcery, qa, grimoire, project are the ones I'm thinking of).

As I said, if you can show it's a common interpretation of signatures 
that they mean something trascendental to what FIPS-186 denotes, I'm 
willing to add support for spell signing directly to sorcery (which 
creates a level of indirection that you should be content with).  That 
brings up the problem of increasing complexity of code and might lead to 
a failure of users to trust the system due to its increased complexity.  
So the "amount" of misunderstanding would have to be more than 
proportional to the increased compexity that we would be adding.  I'd 
say it adds 10% complexity to the system if we add direct spell or 
DETAILS signing.  If you can show that this mistake is common enough to 
warrant that increased complexity, I'll agree with you (on this matter 
only).

Seth

P.S. It has come to my attention that a patch with what you would like 
to see would go a long way toward improving your argument's viability.  
Just something to consider at this juncture.  I don't have time now to 
code it since I'm assigned to work on the "signet" command that 
automates guru signatures and proper key generation.  But if you wanted 
to, it might help, although bridges may have been charred too much for 
that to hold any sway any longer.

P.P.S.  Regarding charred bridges, I think next time you might tread 
lighter responding to certain people, although it's really a mutual 
suggestion -- I think others have not been as lightly treading as they 
could have been as well, myself included.

-- 
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Quality Assurance Team Leader & Security Team: Source Mage GNU/linux
Linux so advanced, it may as well be magic http://www.sourcemage.org
Secretary Pacific Green Party of Oregon http://www.pacificgreens.org
Key id FDCEE733 = 5302 B414 64C4 6112 3454  E082 99F0 69DC FDCE E733

Attachment: pgpq8G4S4o_hI.pgp
Description: PGP signature