Mailing-List: contact general-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: general@incubator.apache.org
Received-SPF: pass (athena.apache.org: local policy)
From: "Mattmann, Chris A (388J)" <chris.a.mattmann@jpl.nasa.gov>
To: "general@incubator.apache.org" <general@incubator.apache.org>
Date: Mon, 27 Jun 2011 13:48:09 -0700
Subject: Re: KEYS and releases
Thread-Topic: KEYS and releases
Thread-Index: Acw1CzTNikWAkUQ5SOygTjs/O8Rbgg==
Message-ID: <5BB598E0-4CB3-4DD7-9521-F1D13258F48C@jpl.nasa.gov>
References: <CMECLHIGIKFCOPHDFPNOMEFKMAAB.noel@devtech.com>
 <68EAAEF4-FFAB-4822-84BC-5A3D5BCB02D9@jpl.nasa.gov>
 <BANLkTimAiwpAs3pWUEqK0xUhc8Y5fd4c5g@mail.gmail.com>
In-Reply-To: <BANLkTimAiwpAs3pWUEqK0xUhc8Y5fd4c5g@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0

Hi Benson,

On Jun 27, 2011, at 1:37 PM, Benson Margulies wrote:

> Chris,
>=20
> If my goal was to hoodwink you, I'd create a bogus key that claimed to
> be owned by an Apache person, put it in a KEYS file, and include in
> the release, and sign the release with it. If I was lucky, you'd just
> verify the release with the embedded key, and I'd have succeeded. We
> want people to use keys from some source OTHER than the mirrors to
> verify. There is a non-zero risk of compromise of the many mirrors.

Sorry, missing the point here. How would you hoodwink me by including a bog=
us key in a KEYS file included in a distro that only Apache people have the=
 right to seed any easier than hoodwinking me by placing that same bogus ke=
y in a place that only Apache people have the right to see (the /dist direc=
tory on minotaur)?

Cheers,
Chris

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Chris Mattmann, Ph.D.
Senior Computer Scientist
NASA Jet Propulsion Laboratory Pasadena, CA 91109 USA
Office: 171-266B, Mailstop: 171-246
Email: chris.a.mattmann@nasa.gov
WWW:   http://sunset.usc.edu/~mattmann/
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Adjunct Assistant Professor, Computer Science Department
University of Southern California, Los Angeles, CA 90089 USA
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org