Public SourceMage Discussion List

["Sergey A. Lipnevich" <sergey AT optimaltec.com>]

Quoting Seth Alan Woolley <seth AT positivism.org>:

> I'll explain standards however I want to.  If they are wrong, people
> will reply thusly.  If they are correct, they will be accepted.

Unfortunately, you can't explain standards this way. If the standard is
ambiguous, it's not a good standard. Your explanations are taking advantage of
the wording that does not define certain terms, and you in good faith have to
acknowledge the fact that you're no a recognized authority on this subject,
when doing so.

> If the explanation below reinforces your point, we should dump
> SOURCE_HASH too.

No, please see my "threat analysis" message.

> > Words like "authenticity" and "identity" run through your citings of
> > FIPS-186. I don't want people coming to *me* to check authenticity of
> > xyz-1.2.3.tar.bz2,
>
> They check the *authenticity* of the *sender*, not of the tarball.  They
> check the *integrity* of the *tarball*.

Gotcha! When you say Nike shoes are authentic, it doesn't mean that Nike is
authentic. You're saying this about the thing Nike produced. Us signing
tarballs is like putting a seal of approval without really analyzing the
subject of this approval. So, fallacy of your logic is: there is no such thing
as authenticity of the sender, there's only authenticity of the tarball.

> Let's say they do come to you to check the integrity.  Is that not what
> happens currently with hashsums?

I want it to remain an option.

> And a HISTORY file for authentication.... Your identity!

History record doesn't mean I read the tarball.


> OK, we'll issue you a random number, the comment field links to the
> security policy.  The name contains the number (which will most likely
> be a hashsum of your name).  There will be no easy way for people to get
> to your randomly issued number back to your identity unless they look up
> a list in our security policy where they will clearly read about what
> the signature means.  We can even throw away the index and make it hard
> to authenticate but easy to non-repudiate.
>
> Then your identity isn't associated with it more than your signing of a
> spell.  In fact, less so.
>
> > And just so I know, do you keep in mind that I am not opposing the use of
> > signatures? I am opposing the mandatory use.
>
> What circumstance would make acceptable a third-party source signing by
> a member of our team?

No, see my answers above and the "threat profile" message.

Sergey.