Public SourceMage Discussion List

["Sergey A. Lipnevich" <sergey AT optimaltec.com>]

Quoting dave AT sourcemage.org:

> > It's a good thing you're reading standards, but let me ask about your
> > entitlements. Disclosure: I don't have any security-related 
> > certifications. Do
> > you? If we're just two guys argueing about merits of the standard, then I'm
> > afraid we read remain at a disagreement.
>
> For what it's worth, I'm a CISSP. You can look up my last name here:
> https://www.isc2.org/cgi/cert_verification.cgi?displaycategory=1300

It's great we have CISSP among us.

> Your fellow devlopers are telling you the truth dude.

What exactly do you mean? The part that the signature allows to check for
authenticity of the package and the identity of the originator, established
with Seth's help, I actually agree with. Hence my objection to being such an
originator. Disclaiming authenticity and identity means that only integrity is
left. And we agree I believe that integrity is adequately assured by hashes.
Eric suggested stronger hashes. I agreed.

Moreover, I am suggesting moving to an SCM system that has built-in commit
signatures. If I'm not mistaken, Montone can do that, and Subversion with
client certificates (not using PGP, but e-commerce style PKI).

> I can't believe
> this discussion has gone on as long as it has.

Me neither, but for different reasons I guess.

> The very idea that so
> many of the primary developers of this project would be asking you to do
> something grossly irresponsible, or worse, trying to trick you into it
> with word games is adolescent and ridiculous. Look at the guys who are

It is. To me it's ridiculuos too that I have to sign (assure authenticity and
identify myself as originator of ) a package I didn't inspect under pressure
from fellow developers.

> talking to you, and look at what they are saying, and ask yourself
> what's more likely, that there's some GPG conspiracy sweeping through

No conspiracy. I believe Jeremy made it clear that the agenda of the sorcery
team is such that they don't want to support hashes.

> the leadership of SMGL, or that your understanding of signatures might
> have been a bit off.

I understand signatures correctly. That's why I don't sign things blindly to
begin with.

> I'm not trying to be mean, but the wording of some of your latest emails
> has ticked me off a bit.

Could you please respond to my "threat profile analysis" message then? As a
CISSP, you must be familiar with this process, as it's one of the first steps
to securing the infrastructure: understanding and prioritizing the threats.
Isn't that right?

Thanks,
Sergey.