Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Wed, 31 Aug 2005 11:43:41 -0400

Quoting dave AT sourcemage.org:

It's a good thing you're reading standards, but let me ask about your
entitlements. Disclosure: I don't have any security-related certifications. Do
you? If we're just two guys argueing about merits of the standard, then I'm
afraid we read remain at a disagreement.

For what it's worth, I'm a CISSP. You can look up my last name here:
https://www.isc2.org/cgi/cert_verification.cgi?displaycategory=1300

It's great we have CISSP among us.

Your fellow devlopers are telling you the truth dude.

What exactly do you mean? The part that the signature allows to check for
authenticity of the package and the identity of the originator, established
with Seth's help, I actually agree with. Hence my objection to being such an
originator. Disclaiming authenticity and identity means that only integrity is
left. And we agree I believe that integrity is adequately assured by hashes.
Eric suggested stronger hashes. I agreed.

Moreover, I am suggesting moving to an SCM system that has built-in commit
signatures. If I'm not mistaken, Montone can do that, and Subversion with
client certificates (not using PGP, but e-commerce style PKI).

I can't believe
this discussion has gone on as long as it has.

Me neither, but for different reasons I guess.

The very idea that so
many of the primary developers of this project would be asking you to do
something grossly irresponsible, or worse, trying to trick you into it
with word games is adolescent and ridiculous. Look at the guys who are

It is. To me it's ridiculuos too that I have to sign (assure authenticity and
identify myself as originator of ) a package I didn't inspect under pressure
from fellow developers.

talking to you, and look at what they are saying, and ask yourself
what's more likely, that there's some GPG conspiracy sweeping through

No conspiracy. I believe Jeremy made it clear that the agenda of the sorcery
team is such that they don't want to support hashes.

the leadership of SMGL, or that your understanding of signatures might
have been a bit off.

I understand signatures correctly. That's why I don't sign things blindly to
begin with.

I'm not trying to be mean, but the wording of some of your latest emails
has ticked me off a bit.

Could you please respond to my "threat profile analysis" message then? As a
CISSP, you must be familiar with this process, as it's one of the first steps
to securing the infrastructure: understanding and prioritizing the threats.
Isn't that right?

Thanks,
Sergey.





Archive powered by MHonArc 2.6.24.

Top of Page