sm-discuss AT lists.ibiblio.org
Subject: Public SourceMage Discussion List
List archive
Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
- From: Seth Alan Woolley <seth AT positivism.org>
- To: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
- Cc: SM-Discuss <sm-discuss AT lists.ibiblio.org>
- Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
- Date: Wed, 31 Aug 2005 11:16:08 -0700
On Wed, Aug 31, 2005 at 12:38:19PM -0400, Sergey A. Lipnevich wrote:
> Quoting Seth Alan Woolley <seth AT positivism.org>:
>
> >> >What circumstance would make acceptable a third-party source signing by
> >> >a member of our team?
> >>
> >> No, see my answers above and the "threat profile" message.
> >
> > No circumstances?
>
> I'm afraid none of the circumstances would involve directly associating my
> identity with any 3rd-party package, regardless of the disclaimer, so the
> answer is still negative, sorry.
It was indirect. More indirect than a simple hash. The problem case --
the out of context discovery of the source and your signature, is what
worried you. When the identity is forced to go through a disclaimer
(yes this is indirect) such as a click-wrap, you're still disturbed -- I
just don't know why.
How is it still direct to you?
> I tried to show that even from technical POV using GPG signatures (see all
> the
> assumptions in my other message) is not a good idea. I'd appreciate if you
> let
> me know, based on my threat analysis, why I should subject myself to the
> scrutiny of keys if in our case hashes provide the same threat protection
> with
> added convenience of not being personal?
I provided a technical means to remove the personal connection (but
retain non-repudiation) from your key. I still didn't see a direct
response to it.
Seth
--
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Quality Assurance Team Leader & Security Team: Source Mage GNU/linux
Linux so advanced, it may as well be magic http://www.sourcemage.org
Secretary Pacific Green Party of Oregon http://www.pacificgreens.org
Key id FDCEE733 = 5302 B414 64C4 6112 3454 E082 99F0 69DC FDCE E733
Attachment:
pgpFebQnD5HEI.pgp
Description: PGP signature
-
Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
, (continued)
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Eric Sandall, 08/30/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Andrew, 08/30/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Seth Alan Woolley, 08/30/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Sergey A. Lipnevich, 08/30/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Seth Alan Woolley, 08/30/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Sergey A. Lipnevich, 08/31/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Seth Alan Woolley, 08/31/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Sergey A. Lipnevich, 08/31/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Seth Alan Woolley, 08/31/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Sergey A. Lipnevich, 08/31/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Seth Alan Woolley, 08/31/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Sergey A. Lipnevich, 08/31/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, dave, 08/30/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Sergey A. Lipnevich, 08/31/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Andrew, 08/31/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Sergey A. Lipnevich, 08/31/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Dave Josephsen, 08/31/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Sergey A. Lipnevich, 08/31/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Jeremy Blosser (emrys), 08/31/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Sergey A. Lipnevich, 08/31/2005
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Seth Alan Woolley, 08/31/2005
Archive powered by MHonArc 2.6.24.