Re:Sequoia-PGP – A new OpenPGP implementation in Rust
by jandrese on Thursday August 02, 2018 @02:57PM
(#17674389)
That's already three conditions, and those spider up to the conditions above.
It's like ACLs. On the surface they seem so easy, but in practice they're a nightmare to manage because you have to track so many dependencies to figure out a simple yes/no question.
Re:Sequoia-PGP – A new OpenPGP implementation in Rust
by Boulth on Thursday August 02, 2018 @03:41PM
(#17674799)
There is one assigned property (trust) one relations table (signing key, signed key) and one computed property (validity, the output) and one condition.
I'd be very happy to see a simpler solution to the problem of decentralized authenticity.
Some projects do rely on Web of Trust, for example Linux kernel (https://www.kernel.org/signature.html#kernel-org-web-of-trus...) or Arch Linux (https://www.archlinux.org/master-keys/).
For a key to be considered valid it must be either ultimately trusted, signed by ultimately trusted key or one fully trusted valid key or 3 marginally trusted valid keys.
It seems to me there are only two properties to track and quite easy calculation to do (fizz buzz level).