Public SourceMage Discussion List

["Sergey A. Lipnevich" <sergey AT optimaltec.com>]

On Wed, 2005-08-31 at 18:06 -0500, Jeremy Blosser (emrys) wrote:
> But we don't install a tainted spell before they figure this out.  The
> attack and the solution is the same for hashes or signatures, apart from
> some implementation details.

Agreed.

I removed .5 from the sig score in this scenario because remediation
steps for signatures include all the steps for hashes, and then some.
But it was an illustration anyway, .5 and .99 don't matter much here as
long as it's not 1.0. And even if it's 1.0, the score between hashes and
signatures is even.

Sergey.