Return-Path: X-Original-To: apmail-incubator-ooo-dev-archive@minotaur.apache.org Delivered-To: apmail-incubator-ooo-dev-archive@minotaur.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id BD0D19FF8 for ; Fri, 4 May 2012 23:17:24 +0000 (UTC) Received: (qmail 5708 invoked by uid 500); 4 May 2012 23:17:24 -0000 Delivered-To: apmail-incubator-ooo-dev-archive@incubator.apache.org Received: (qmail 5634 invoked by uid 500); 4 May 2012 23:17:24 -0000 Mailing-List: contact ooo-dev-help@incubator.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: ooo-dev@incubator.apache.org Delivered-To: mailing list ooo-dev@incubator.apache.org Received: (qmail 5619 invoked by uid 99); 4 May 2012 23:17:24 -0000 Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136) by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 04 May 2012 23:17:24 +0000 X-ASF-Spam-Status: No, hits=0.7 required=5.0 tests=RCVD_IN_DNSWL_NONE,SPF_NEUTRAL X-Spam-Check-By: apache.org Received-SPF: neutral (athena.apache.org: local policy) Received: from [208.113.200.5] (HELO homiemail-a54.g.dreamhost.com) (208.113.200.5) by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 04 May 2012 23:17:16 +0000 Received: from homiemail-a54.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a54.g.dreamhost.com (Postfix) with ESMTP id 7B4433A4058; Fri, 4 May 2012 16:16:55 -0700 (PDT) Received: from [192.168.43.7] (unknown [151.81.50.205]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) (Authenticated sender: andrea@pescetti.it) by homiemail-a54.g.dreamhost.com (Postfix) with ESMTPSA id 310D33A4057; Fri, 4 May 2012 16:16:53 -0700 (PDT) Message-ID: <4FA4635E.7070509@apache.org> Date: Sat, 05 May 2012 01:16:46 +0200 From: Andrea Pescetti User-Agent: Mozilla/5.0 (X11; Linux i686; rv:11.0) Gecko/20120329 Thunderbird/11.0.1 MIME-Version: 1.0 To: ooo-dev@incubator.apache.org Subject: Re: [RELEASE]: download page on the AOO project webpage References: <4FA3B923.1010403@googlemail.com> <2CE7ABE6-E558-451E-832A-1D80BC2750AA@comcast.net> <633D1E2F-54CB-4978-8E50-CBC7C6B3FC0E@comcast.net> In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Checked: Checked by ClamAV on apache.org On 04/05/2012 Rob Weir wrote: > And Apache /dist serving the hashes for verification This is surely OK, but the project policy at OpenOffice.org was to additionally send an e-mail to a public list (it would be ooo-dev with the current settings) with all checksums. While it may sound odd, it makes sense since the list is publicly archived in several places, so if the website is hacked (or simply if its revision history is lost due to migration, like it recently happened for openoffice.org) it is always possible to verify that an OpenOffice download is genuine. Regards, Andrea.