Mailing-List: contact ooo-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: ooo-dev@incubator.apache.org
Received-SPF: pass (nike.apache.org: domain of robertburrelldonkin@gmail.com
 designates 209.85.213.47 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <CAOPHaVT1wD_UN3rXhE70zf-tSfNpUYf30Hcmub=4DD_o84Wb2g@mail.gmail.com>
References: <4EA1FD16.4070508@wtnet.de>
	<20111023215030.GB30827@poeml.de>
	<4EA4BA9D.3050500@wtnet.de>
	<CAMwm1vF7Q7WUri7Tk3173f=-h4bS=6unkpD1JYBs5DJ6P6aqHw@mail.gmail.com>
	<C8BEE58B-5B97-4442-9EB5-FB8CC547222B@webmink.com>
	<CAMwm1vGx8QgXVXp=N0YEsVFu7P_2YBykAn2B0rxniB7pRV1E-w@mail.gmail.com>
	<20111024230620.GB21778@daniel3.local>
	<012b01cc92a9$ae3e0450$0aba0cf0$@acm.org>
	<CAOPHaVQprNF2zTsbMeDyM+nQY8Q0EkTjq6v_V1JFhg53GBdQ=A@mail.gmail.com>
	<CAKTa1mj-T17VMT9xZcxbVGbfPjWai9g-GiPGT5_p08=mq2RGKQ@mail.gmail.com>
	<CAOPHaVT1wD_UN3rXhE70zf-tSfNpUYf30Hcmub=4DD_o84Wb2g@mail.gmail.com>
Date: Tue, 25 Oct 2011 16:05:31 +0100
Message-ID: 
 <CAKTa1mje0zT00Jr32sXVpPUD35ON8JP1dOKETpuAhy2BNusPyw@mail.gmail.com>
Subject: Re: Shutdown of the "download.services.openoffice.org" host and its
 Mirrorbrain instance
From: Robert Burrell Donkin <robertburrelldonkin@gmail.com>
To: ooo-dev@incubator.apache.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

On Tue, Oct 25, 2011 at 1:38 PM, Christian Lohmaier
<cloph@openoffice.org> wrote:
> Hi Robert, *,
>
> On Tue, Oct 25, 2011 at 2:15 PM, Robert Burrell Donkin
> <robertburrelldonkin@gmail.com> wrote:
>> On Tue, Oct 25, 2011 at 12:36 PM, Christian Lohmaier
>> <cloph@openoffice.org> wrote:
>>> [...]
>>> That doesn't make sense - integrity is assured by bittorrent by
>>> providing sha1sums for each =A0chunk. And authenticity can be assured
>>> just like it is with regular releases - just include a corresponding
>>> signature file within the torrent.
>>
>> Better to download the signature over HTTPS but yes, I see no reason
>> why this approach could not be made to work
>
> With signature I meant a real signature (gpg signature), not a md5sum
> or sha1sum file.
> When it is a cryptographic signature, it doesn't matter how you
> download it, as it cannot be faked.
> (of course the user has to get the proper key, but that's a different iss=
ue)

FWIW it's a defense in depth measure[1]

>>>> I may have dreamed it or I am mixing this up with something else.
>>>
>>> If those were the only reasons, then they were made-up arguments.
>>
>> When engaging with Infrastructure, expect to be challenged and to have
>> to defend any proposal. These lists are open, so expect a range of
>> cluefulness from contributors. The best way to impress the core
>> infrastructure team is for plenty of clueful people from a project to
>> show up and defend the proposal with well research arguments. Giving
>> up and going away is the surest way to lose the argument...
>
> With OOo the tracker network[1] was run independently anyway and not
> hosted on the Oracle or OSUOSL hosted infrastructure. The main tracker
> was Mike's at utwente, and that mirror also was the initial/main seed
> for all the releases. There were other trackers linked together via a
> tracker-hub (backup tracker as well as the hub were provided by
> Harold).
>
> So it is not a matter of infrastructure, but a matter of policy.

Where's the URL for this policy?

Robert

[1] Consider an attacker with some ability to fabricate convincing
signatures. Downloading the signature from a trusted server means that
such an attacker would need to replace an existing signature on secure
hardware without detection. The small increase in traffic is a small
price to pay for this additional defense in depth.