Public SourceMage Discussion List

[Seth Alan Woolley <seth AT positivism.org>]

missed this one the first time around...

On Wed, Aug 31, 2005 at 06:56:25PM -0400, Sergey A. Lipnevich wrote:
> On Wed, 2005-08-31 at 11:16 -0700, Seth Alan Woolley wrote:
> > It was indirect.  More indirect than a simple hash.  The problem case -- 
> > the out of context discovery of the source and your signature, is what 
> > worried you.  When the identity is forced to go through a disclaimer 
> > (yes this is indirect) such as a click-wrap, you're still disturbed -- I 
> > just don't know why.
> > 
> > How is it still direct to you?
> 
> I said I don't see this disclaimer changing anything. Hence, presence of
> disclaimer anywhere doesn't change much for me.

DETAILS signing is no disclaimer -- I would be more worried that 
somebody intuited the presence of the hash as being an implication of 
quality of the tarball.

> 
> > > I tried to show that even from technical POV using GPG signatures (see 
> > > all the
> > > assumptions in my other message) is not a good idea. I'd appreciate if 
> > > you let
> > > me know, based on my threat analysis, why I should subject myself to the
> > > scrutiny of keys if in our case hashes provide the same threat 
> > > protection with
> > > added convenience of not being personal?
> > 
> > I provided a technical means to remove the personal connection (but 
> > retain non-repudiation) from your key.  I still didn't see a direct 
> > response to it.
> 
> My key is my key, right? No matter how we dance around it I'd become an
> originator of this tarball. And if the tarball is compromised, I'd have
> to revoke this key. 

Actually, you revoke the key when your key is compromised, not when a 
tarball is compromised.

When an apache tarball is compromised, they don't revoke their signing keys.
Whe GNU was compromised, they didn't revoke their keys.

They sent a signed message that something was wrong with something they 
signed (in the case of APACHE) or distributed (in the case of GNU) -- we 
have ways to do the same.

Seth

-- 
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Quality Assurance Team Leader & Security Team: Source Mage GNU/linux
Linux so advanced, it may as well be magic http://www.sourcemage.org
Secretary Pacific Green Party of Oregon http://www.pacificgreens.org
Key id FDCEE733 = 5302 B414 64C4 6112 3454  E082 99F0 69DC FDCE E733

Attachment: pgp6dYxEwlT4D.pgp
Description: PGP signature