Public SourceMage Discussion List

[Seth Alan Woolley <seth AT positivism.org>]

On Wed, Aug 31, 2005 at 12:07:56AM -0400, Sergey A. Lipnevich wrote:
> Quoting Seth Alan Woolley <seth AT positivism.org>:
> 
> >>It's a good thing you're reading standards, but let me ask about your
> >>entitlements. Disclosure: I don't have any security-related
> >>certifications.  Do you? If we're just two guys argueing about merits
> >>of the standard, then I'm afraid we read remain at a disagreement.
> >
> >Did you just admit that you'd take the decision of somebody who is paper
> >certified over your own?
> 
> No, I'm trying to politely say that you should prepend your explanation of
> stsndards with "IMO." I just did.

I'll explain standards however I want to.  If they are wrong, people 
will reply thusly.  If they are correct, they will be accepted.

> 
> >>I am also not confusing things as you suggested. I am trying to
> >>explain them to those who are willing to listen. I am also trying to
> >>have my choice back.
> >
> >I hope the suggestion above will be a good compromise?
> 
> No, because I am still the originator of the tarball if I sign it. 
                         ^^^ an

There's no need for a definite article there.

> I'm not going to reply to the whole piece you had above. Suffice it to 
> say that it reinforces my point. 

If the explanation below reinforces your point, we should dump 
SOURCE_HASH too.

> Words like "authenticity" and "identity" run through your citings of 
> FIPS-186. I don't want people coming to *me* to check authenticity of 
> xyz-1.2.3.tar.bz2,

They check the *authenticity* of the *sender*, not of the tarball.  They 
check the *integrity* of the *tarball*.

Let's say they do come to you to check the integrity.  Is that not what 
happens currently with hashsums?

> and I don't want them 
> to associate my identity with it. They have "tar tjf" to check for 
> elementary breakage and a hashsum to check for integrity. 

And a HISTORY file for authentication.... Your identity!

> I believe that's enough. Moreover, I believe I will do injustice to 
> them *and* myself by giving them more.

OK, we'll issue you a random number, the comment field links to the 
security policy.  The name contains the number (which will most likely 
be a hashsum of your name).  There will be no easy way for people to get 
to your randomly issued number back to your identity unless they look up 
a list in our security policy where they will clearly read about what 
the signature means.  We can even throw away the index and make it hard 
to authenticate but easy to non-repudiate.

Then your identity isn't associated with it more than your signing of a 
spell.  In fact, less so.

> 
> And just so I know, do you keep in mind that I am not opposing the use of
> signatures? I am opposing the mandatory use.

What circumstance would make acceptable a third-party source signing by 
a member of our team?

Seth

> 
> Sergey.
> 

-- 
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Quality Assurance Team Leader & Security Team: Source Mage GNU/linux
Linux so advanced, it may as well be magic http://www.sourcemage.org
Secretary Pacific Green Party of Oregon http://www.pacificgreens.org
Key id FDCEE733 = 5302 B414 64C4 6112 3454  E082 99F0 69DC FDCE E733

Attachment: pgpPfB3UDrhue.pgp
Description: PGP signature