Public SourceMage Discussion List

[dave AT sourcemage.org]

On Tue, Aug 30, 2005 at 04:43:40PM -0400, Sergey A. Lipnevich wrote:
> Quoting Seth Alan Woolley <seth AT positivism.org>:
> 
> >   Furthermore, the recipient may wish to be certain of the originator's
> >   identity.
> >
> > Who sent it!
> 
> So let me break it you if that's still not clear: I don't want to be the
> originator of any tarball I didn't read the code of. And no, originator is 
> not
> just who sent it. The build engineer is the originator, and if they're not
> willing to sign it, I am not in a position to second-guess them.
> 
> It's a good thing you're reading standards, but let me ask about your
> entitlements. Disclosure: I don't have any security-related certifications. 
> Do
> you? If we're just two guys argueing about merits of the standard, then I'm
> afraid we read remain at a disagreement.

For what it's worth, I'm a CISSP. You can look up my last name here:
https://www.isc2.org/cgi/cert_verification.cgi?displaycategory=1300

Your fellow devlopers are telling you the truth dude. I can't believe
this discussion has gone on as long as it has. The very idea that so
many of the primary developers of this project would be asking you to do
something grossly irresponsible, or worse, trying to trick you into it
with word games is adolescent and ridiculous. Look at the guys who are
talking to you, and look at what they are saying, and ask yourself
what's more likely, that there's some GPG conspiracy sweeping through
the leadership of SMGL, or that your understanding of signatures might
have been a bit off. 

I'm not trying to be mean, but the wording of some of your latest emails
has ticked me off a bit. 
 
> I am also not confusing things as you suggested. I am trying to explain 
> them to
> those who are willing to listen. I am also trying to have my choice back.
> 
> Sergey.

--dave.

Attachment: pgpqEv9yBgB_Q.pgp
Description: PGP signature