Public SourceMage Discussion List

[Eric Sandall <eric AT sandall.us>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, 31 Aug 2005, Sergey A. Lipnevich wrote:
<snip>
> > Further, if you truly believe that someone signing a package is making a
> > claim they have audited the source, and you believe that other people share
> > this believe, you *should* be opposed to anyone signing something and
> > making that claim, because it would put our users and even our distribution
> > in jeopardy.  In fact, if you believe signatures mean what you say you do,
> > you should probably be opposed to use included upstream signatures, because
> > those vendors make it clear in their other documents that they disclaim all
> > warrantees.  If providing an upstream signature is going to make most users
> > believe they have guarantees they do not have, we would be irresponsible to
> > include them.
<snip>
> Remember how long it took for GNU to recover after their servers were
> breached? Why do you think it was? If they disclaim all warranties, why
> would they take it upon themselves to verify each and every file before
> putting it back on the server. And not just verify, but go back to the
> author(s) of each source and make sure they verify it? Obviously, this
> involves trust. They feel that they have to keep your trust in taking
> the breaches seriously. If I were put in this position, I would be very
> disappointed that something I signed could not be trusted.
<really big snip>

I believe the reason they went and verified every tarball has nothing
to do with whether they used GPG to sign it, but everything to do with
them not wanting to put a corrupted tarball up again after having been
alerted to it and spending all this time taking them down, causing
inconvenience to many. This argument has nothing to do with GPG
signing, so I don't know why you brought it up.

- -sandalle

- --
Eric Sandall                     |  Source Mage GNU/Linux Developer
eric AT sandall.us                  |  http://www.sourcemage.org/
http://eric.sandall.us/          |  SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/  #196285  |  http://www.shock.wsu.edu/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDFp8+HXt9dKjv3WERAthBAJ9Q4ZmwxDi0CdubOjVJ+OkG+S+ElQCgw1yl
w8F0lcPoG5sN8DIrTxn97nU=
=Au3p
-----END PGP SIGNATURE-----