[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CA+O_gMyxU+pRkz_5Q30WM2wzktqoVJUDMxASJWi6DDx2C5VqKw@mail.gmail.com>
Date: Thu, 2 May 2013 10:02:36 +1200
From: Robbie MacKay <robbie@...ahidi.com>
To: oss-security@...ts.openwall.com
Subject: Re: upstream source code authenticity checking
I'd just like to +1 creating a good set of guidelines for signing releases.
Especially if it gives a "baseline", "level 1", "level 2", etc. set of
standards.
I'm an open source developer working in a small team. We need to improve
our processes but sometimes don't have the time to figure out the best way.
Guidelines would speed that up for us and give me something I can point at
to convince my team mates.
On Wed, May 1, 2013 at 6:24 AM, Daniel Kahn Gillmor
<dkg@...thhorseman.net>wrote:
> On 04/26/2013 01:57 AM, Alistair Crooks wrote:
> > All people can see from a key listing is who trusted them and
> > when, not how much, or whether the trust was warranted.
>
> Just for the record, most OpenPGP key certification listings don't
> indicate anything at all about trust, including "who trusted them".
> they show cryptographically-verifiable assertions of identity and
> control over key material.
>
> Put another way, a signature on an OpenPGP key+userid says "I believe
> that this key belongs to this person" -- it doesn't say anything about
> trust in that person (or about their intrinsic trustworthiness).
>
> Sorry for the nit-pick, but the term "trust" is so overused and confused
> in these contexts that i think it's important to clarify it when it's
> getting muddled.
>
> Regards,
>
> --dkg
>
>
--
Robbie Mackay
Software Developer, External Projects
Ushahidi Inc
m: +64 27 576 2243
e: robbie@...ahidi.com
skype: robbie.mackay
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
