Public SourceMage Discussion List

["Sergey A. Lipnevich" <sergey AT optimaltec.com>]

On Wed, 2005-08-31 at 14:09 -0500, Dave Josephsen wrote:
> Quite honestly, I don't see the point.   
> 
> Argument after Argument in this thread you've put the onus on the rest
> of this development team to prove you wrong, and point after point

No, I am trying to keep a feature in the sorcery, not prove anything to
you. If you would like to sign 3rd party packages, I don't object. I
don't want to do it myself. It's not about being wrong, it's about
choice. I do try top explain my view in more details, simply because I'm
being forced to do something that I think is wrong, and I do fight back
to show futility of attempts to somehow provide "better" integrity
checking with signatures instead of hashes.

> they've done so with links to relevant texts, plain english
> explanations, and follow-up emails where they're explanations could
> have been misinterpreted. Each time you respond by silently abandoning
> the point, creating a new point, Fabian-esque redefinitions of
> terminology, and combinations thereof. I'd like to see what Jeremy asked

It's the disclaimer on the site that tries to redefine the terminology,
not me.

> you for, a single documented example of GPG signatures being used by an
> OSS project in the way you describe them being used. The onus is on you
> now. 

Is that the only the only things that I missed? I missed more, simply
because I am arguing with several people about different things, and if
I don't address every single one of them it's because their relevance is
lower than of the ones I try to address.

> You've been confronted with the facts to the extent of Seth reading the
> standards to you. If you're not going to be convinced that you are in
> error by the literal text, I don't see what magical resolution my lofty
> CISSP could bring to this thread. Perhaps someone should compare someone
> else to a nazi so we can be done with this. 

It'd be enough to keep a feature in the sorcery.

> What concerns me are the developers reading the thread who are actually
> confused about the difference between hashsums and signatures, and SMGL
> missing out on some rather wickedly cool functionality because of all

I tried to prove that this wickedly cool functionality is simply a toy
without much practical sense. You are free to play with it; I for one am
not interested. Let me repeat, because you seem to be confusing my point
with something in your head: I don't mind, sign away all you want.

I'm asking that you look at "threat analysis" thread and see that I have
actually identified most attacks and showed that signatures do not help,
and sometimes even worsen, the consequences of the attack. The talk is
not over in this thread, but the net result is that downloading a fresh
signed grimoire tarball with hash values is enough.

> the doublespeak. We could be one of the very few (only?) distros out
> there with a fully integrated upstream GPG based web-of-trust style

I don't object to integrating upstream. Did you notice that? If upstream
provides signatures, I'm all for including them. Judging by current
features in devel sorcery, we already are this thing you describe. Which
is a great accomplishment, no doubt. What I'm tryign to prevent is
taking this accomplishment to an unnecessary and (IMO) dangerous
extreme.

> verification model down to the package level. Jblosser already has a

Marketing speak alert. Buzzword in your sentence is: trust. Let me
explain. Seth himself admitted that there's no added security in this
functionality, it doesn't add any more "trust," the same as with hashes.
I said exactly that when we were starting with MD5 signatures: calling
this a "security" or "trust" feature is misleading. Integrity is most of
what we can claim. I knew that somebody someday would say something like
that, and it's funny that a CISSP did that.

> huge head start on it, and let me tell you, it's good stuff. If anyone
> has a problem with not being sure how it works, please grab one of us in

I know how it works, and I know it well enough. If you or anyone take it
upon themselves to be an SMGL security architects, then maybe they
should analyze the problem well before coming up with a solution. I
already did some work for you.

> irc and talk about it. If you're still not sure what your sig would mean,
> or think we're telling you to do things that will hurt your karma with
> your private key, post a bug with your finished spell, and the requisite
> verification homework, and I'll sign it for you. That's you included

That's all I ask: leave me alone and don't make me sign things. If you
require me to do that, I am not interested in contributing. The bottom
line is, I'm really interested in seeing the end of this discussion and
hearing the final decision. Depending on it, I'll make my decisions.

Sergey.