Public SourceMage Discussion List

["Sergey A. Lipnevich" <sergey AT optimaltec.com>]

On Wed, 2005-08-31 at 11:16 -0700, Seth Alan Woolley wrote:
> It was indirect.  More indirect than a simple hash.  The problem case -- 
> the out of context discovery of the source and your signature, is what 
> worried you.  When the identity is forced to go through a disclaimer 
> (yes this is indirect) such as a click-wrap, you're still disturbed -- I 
> just don't know why.
> 
> How is it still direct to you?

I said I don't see this disclaimer changing anything. Hence, presence of
disclaimer anywhere doesn't change much for me.

> > I tried to show that even from technical POV using GPG signatures (see 
> > all the
> > assumptions in my other message) is not a good idea. I'd appreciate if 
> > you let
> > me know, based on my threat analysis, why I should subject myself to the
> > scrutiny of keys if in our case hashes provide the same threat protection 
> > with
> > added convenience of not being personal?
> 
> I provided a technical means to remove the personal connection (but 
> retain non-repudiation) from your key.  I still didn't see a direct 
> response to it.

My key is my key, right? No matter how we dance around it I'd become an
originator of this tarball. And if the tarball is compromised, I'd have
to revoke this key. I don't want that. Not because I'm difficult, but
because as I have shown, it's not worth the trouble and risk for me. In
all cases, signatures don't make things any better.

I appreciate what you are trying to do Seth, it's very constructive.
It's signing tarballs against my will that will never sit well in my
mind. For example, I used to be a Subversion committer, and I read a lot
of its code. I trust people on the team, and I know all code is being
reviewed, because the make it so. I'd feel very comfortable signing
their tarball. They however already provide such signatures, so my
support is not needed. For packages that don't have signatures, their
authors' level of development culture is probably lower (or they don't
want to deal with signatures), so there's no reason to make these
tarballs appear to be coming from a trusted source.

At this point, you've done a lot, but you can't step over this
"mandatory signatures" policy. I remain in opposition of it. I believe
we're ready to hear the verdict.

Sergey.