Mailing-List: contact community-help@apache.org; run by ezmlm
Precedence: bulk
Reply-To: community@apache.org
From: "Noel J. Bergman" <noel@devtech.com>
To: <community@apache.org>
Cc: <infrastructure@apache.org>
Subject: RE: bogus subs to mailing lists (more?)
Date: Wed, 5 Nov 2003 17:57:39 -0500
Message-ID: <NBBBJGEAGJAKLIDBKJOPIEMNFBAB.noel@devtech.com>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Importance: Normal
In-Reply-To: <49CAAA53-0FB4-11D8-91CE-000A958871C6@hisitech.com>

> I think the moment is coming where we should think about using those
> interesting GPG keys for something more than "just" signing releases.

S/MIME certificates are acquired, e.g., from Thawte, just as you would an
SSL certificate.  There are root Certificate Authorities, just as for HTTPS.
Any good mail client has built-in support.  Thawte certificates are free,
although they have limited verification until you start to get signed by
Thawte notaries (another web-of-trust concept).

> Is there any way, for instance, to allow messages signed by Apache
> committers to pass through to any public Apache list unmoderated?

How do you propose getting a critical mass of signed mail, and what do you
want to do in the meantime with unsigned mail from a subscriber?

The mail server would need everyone's public key to verify the signatures.
But how does that solve the problem?  Are you going to require *ALL*
messages to be signed?

Mind you, I've been saying for years that, because of spam, e-mail anonymity
is going to die.  All messages will be required to be digitally signed, or
will be considered spam a priori.  So your view does not bother me in the
slightest, but other people consider that there is a right to send anonymous
e-mail.  I agree.  I'd just mark it as spam.  But until S/MIME is the
accepted norm, rather than the exception, I don't see that it offers a
solution.

	--- Noel


---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org