Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Eric Sandall <eric AT sandall.us>
  • To: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Wed, 31 Aug 2005 23:23:54 -0700 (PDT)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, 31 Aug 2005, Sergey A. Lipnevich wrote:
On Wed, 2005-08-31 at 17:59 -0500, Jeremy Blosser (emrys) wrote:
<big snip>
I'm sorry, but I don't think that's why you "missed" those things. You
have several times gotten into repeating a particular point a few times,
until one of us responded and quite clearly demonstrated problems with your
argument. You have then jumped to another argument in another part of the
thread. In fact, yesterday you repeated this "show me one OSS project"
challenge alongside a claim your own questions were being ignored by me and
others. Then you never responded to our response.

I just did. Even more so. I showed you arguments that you couldn't argue
against: the attacks are possible regardless of use of
hashes/signatures, and using signatures doesn't improve anything.
<other big snip>

The attacks are possible, but with GPG we have knowledgable
cryptographic developers working on figuring out the best hash to use
and we won't have to change a thing in Sorcery. That's one thing. One
other is that, with GPG, there is functionality built-in to revoke bad
signatures even if the users don't update their grimoires. With
hashsums we'd have to write our own. That's two. There are more, but
you just asked for anything and I gave you anything + 1.

- -sandalle

- --
Eric Sandall | Source Mage GNU/Linux Developer
eric AT sandall.us | http://www.sourcemage.org/
http://eric.sandall.us/ | SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/ #196285 | http://www.shock.wsu.edu/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDFp5+HXt9dKjv3WERArRLAKCO6zbbd3CIiVLV0fQXh0FyZBvT1QCgreAc
0pbuTmwLRJW7nfzHUhrIYWQ=
=+uVl
-----END PGP SIGNATURE-----




Archive powered by MHonArc 2.6.24.

Top of Page