Skip to Content.
Sympa Menu

sm-security - Re: [SM-Security] openPGP security by signing

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • To: Seth Woolley <seth AT tautology.org>
  • Cc: sm-security AT lists.ibiblio.org
  • Subject: Re: [SM-Security] openPGP security by signing
  • Date: Wed, 14 May 2003 22:57:09 -0400



Seth Woolley wrote:

they can't trojan another spell). I want people who cast sendmail to be
trusting sendmail, not joe blow whose key we happened to sign since he has
a spell in our grimoire.


Let me make sure I understand this. Are you saying that the trust to the original package should extend to our spell? That's impossible AFAICT. Neither Sendmail nor Apache nor many other teams who provide gpg signatures will not agree to sign our spells' code. Moreover, our spell may be harmful while the package is not, and vice versa. So, I don't understand the statement above that you made. Could you please clarify?

Sergey.

BTW, linux spell signature checking is an awesome example, really cool.





Archive powered by MHonArc 2.6.24.

Top of Page