Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Seth Alan Woolley <seth AT positivism.org>
  • To: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • Cc: SM-Discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Tue, 30 Aug 2005 23:02:36 -0700

On Wed, Aug 31, 2005 at 12:07:56AM -0400, Sergey A. Lipnevich wrote:
> Quoting Seth Alan Woolley <seth AT positivism.org>:
>
> >>It's a good thing you're reading standards, but let me ask about your
> >>entitlements. Disclosure: I don't have any security-related
> >>certifications. Do you? If we're just two guys argueing about merits
> >>of the standard, then I'm afraid we read remain at a disagreement.
> >
> >Did you just admit that you'd take the decision of somebody who is paper
> >certified over your own?
>
> No, I'm trying to politely say that you should prepend your explanation of
> stsndards with "IMO." I just did.

I'll explain standards however I want to. If they are wrong, people
will reply thusly. If they are correct, they will be accepted.

>
> >>I am also not confusing things as you suggested. I am trying to
> >>explain them to those who are willing to listen. I am also trying to
> >>have my choice back.
> >
> >I hope the suggestion above will be a good compromise?
>
> No, because I am still the originator of the tarball if I sign it.
^^^ an

There's no need for a definite article there.

> I'm not going to reply to the whole piece you had above. Suffice it to
> say that it reinforces my point.

If the explanation below reinforces your point, we should dump
SOURCE_HASH too.

> Words like "authenticity" and "identity" run through your citings of
> FIPS-186. I don't want people coming to *me* to check authenticity of
> xyz-1.2.3.tar.bz2,

They check the *authenticity* of the *sender*, not of the tarball. They
check the *integrity* of the *tarball*.

Let's say they do come to you to check the integrity. Is that not what
happens currently with hashsums?

> and I don't want them
> to associate my identity with it. They have "tar tjf" to check for
> elementary breakage and a hashsum to check for integrity.

And a HISTORY file for authentication.... Your identity!

> I believe that's enough. Moreover, I believe I will do injustice to
> them *and* myself by giving them more.

OK, we'll issue you a random number, the comment field links to the
security policy. The name contains the number (which will most likely
be a hashsum of your name). There will be no easy way for people to get
to your randomly issued number back to your identity unless they look up
a list in our security policy where they will clearly read about what
the signature means. We can even throw away the index and make it hard
to authenticate but easy to non-repudiate.

Then your identity isn't associated with it more than your signing of a
spell. In fact, less so.

>
> And just so I know, do you keep in mind that I am not opposing the use of
> signatures? I am opposing the mandatory use.

What circumstance would make acceptable a third-party source signing by
a member of our team?

Seth

>
> Sergey.
>

--
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Quality Assurance Team Leader & Security Team: Source Mage GNU/linux
Linux so advanced, it may as well be magic http://www.sourcemage.org
Secretary Pacific Green Party of Oregon http://www.pacificgreens.org
Key id FDCEE733 = 5302 B414 64C4 6112 3454 E082 99F0 69DC FDCE E733

Attachment: pgpPfB3UDrhue.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page