Public SourceMage Discussion List

["Sergey A. Lipnevich" <sergey AT optimaltec.com>]

Quoting Seth Alan Woolley <seth AT positivism.org>:

> > It's a good thing you're reading standards, but let me ask about your
> > entitlements. Disclosure: I don't have any security-related
> > certifications.  Do you? If we're just two guys argueing about merits
> > of the standard, then I'm afraid we read remain at a disagreement.
>
> Did you just admit that you'd take the decision of somebody who is paper
> certified over your own?

No, I'm trying to politely say that you should prepend your explanation of
stsndards with "IMO." I just did.

> > I am also not confusing things as you suggested. I am trying to
> > explain them to those who are willing to listen. I am also trying to
> > have my choice back.
>
> I hope the suggestion above will be a good compromise?

No, because I am still the originator of the tarball if I sign it. I'm 
not going
to reply to the whole piece you had above. Suffice it to say that it 
reinforces
my point. Words like "authenticity" and "identity" run through your citings of
FIPS-186. I don't want people coming to *me* to check authenticity of
xyz-1.2.3.tar.bz2, and I don't want them to associate my identity with 
it. They
have "tar tjf" to check for elementary breakage and a hashsum to check for
integrity. I believe that's enough. Moreover, I believe I will do injustice to
them *and* myself by giving them more.

And just so I know, do you keep in mind that I am not opposing the use of
signatures? I am opposing the mandatory use.

Sergey.