Re: digital signatures

[Paul Kienzle]

On Apr 1, 2004, at 1:07 PM, Steve Lipa wrote:

> On Apr 01 Przemek Klosowski (address@hidden) wrote:
> > MD5SUM, when it is computed by John on his personal system right after
> > generating the binaries, and distributed in a way that does not allow
> > for surreptitious modification, are as secure as digital signature.
>
> That's right.  The part about being "distributed in a way that does  
> not allow
> for surreptitious modification" is the whole problem.   Digital  
> signatures
> greatly mitigate this problem.  That is why everybody with a clue is  
> starting
> to use them.
>
> Let's face it, the whole point of rooting the server is to inject  
> trojans
> into the code all of the users are downloading.  The tiny cost of  
> generating
> a digital signature can greatly reduce the chances of this succeeding.
>
> Dr. Eaton and the Octave maintainers have typed hundreds of thousands  
> of
> lines of code for the benefit of their user base, for which we are  
> profoundly
> thankful.   Typing one more line
>
>   gpg --sign -b -o octave-2.1.60.tar.gz.sig octave-2.1.60.tar.gz
>
> can provide significant, valuable protection for their product and  
> their
> user base.  Why not do it?

I'm not sure signatures would help octave-forge much.  Unlike John,
we do not have a private CVS copy which is mirrored publicly.   
Signatures
will not protect against someone rooting source forge and hacking
code into the octave-forge CVS repository.  And unlike John nobody is
filtering every patch that gets made.

If you have the time and  energy to do so, you are welcome to watch
the changes on every file and sign and distribute your own version of
the package.  I'm happy to put a link on the front page, and the
community can vote with their feet.

Splitting octave-forge into small enough packages that users can
thoroughly examine the code before they use it is another approach.
Etienne had an automatic dependency checker on his site oh
so long ago --- you could resurrect that for octave-forge.

Octave-forge accounts are available for the asking.  If it would
make people feel more comfortable, we could 'age' accounts,
and eliminate those who haven't contributed in the past year.   I'm
not sure that this impacts security much.

We could also raise the barrier to getting new accounts if someone
wants to take the role of editor.  Most contributors submit one or
two things (if that) and disappear, which I understand is the norm
for open source projects (some pithy quote about fools applies to
the rest of us).  Having an editor makes contributing easier and
improves code quality, but it can be a lot of work.  Especially with
a community that is growing exponentially:
	http://sourceforge.net/project/stats/index.php? 
report=months&group_id=2888

All these suggestions require considerably more work than typing
one extra line during build.

Paul Kienzle
address@hidden