Public SourceMage Discussion List

[Jeremy Blosser <jblosser-smgl AT firinn.org>]

On Sep 12, Thomas Orgis [thomas-forum AT orgis.org] wrote:
> Am Fri, 11 Sep 2015 12:56:23 -0700
> schrieb Eric Sandall <eric AT sandall.us>: 
> 
> > Git itself protects us
> > from out-of-process modifications.
> 
> Could you elaborate on that? For sure, someone with root access to the
> hosting machine can fake any commit desired by manipulating the
> repository on disk? Only the commit data itself is protected against
> modification by a hash sum. 

As I said we would keep the distribution point our own server.  Meaning
anything that went out to users would go through us last, like it does now.
That end would likely be kept current with the upstream repo by git,
meaning the data on disk would match what the commit mail for that hash
commit showed.  And it would also mean we'd be the ones in the position to
audit it at any point.

> You see where taking professional paranoia seriously, personally, is
> taking all the fun out of life? For businesses, it's simple, they have
> contracts and can sue people, every loss is just a monetary loss in the
> end. You still got your life (although you might be poor and don't
> value it much). When I loose control over my digital life, that's a
> different impact. I hate to sound that crazy, but I tend to think
> things through and that's where I end up when not stopping inside the
> comfort zone.

Please don't think you're the only person here who is professionally
paranoid.  I have clients who are kept out of the cloud for exactly these
reasons, and they use me to provide their services because they know I
understand and can deal with their concerns.  There are ways to take
advantage of things the cloud offers without surrendering control of the
end product, though you have to scope and architect things correctly.

Attachment: pgpqGcatrPZEJ.pgp
Description: PGP signature