Re:Why Package Signing is not the Holy Grail
by VLM on Wednesday July 24, 2013 @08:22AM
(#6095724)
"This isn't an already solved problem nor is it an easy to solve one."
This isn't even a defined problem, much less solved or easily solved. A goal would help a lot. I searched the article and the comments for the word "goal" and found nothing. It is an OK laundry list of several tools and techniques and their strengths and weaknesses in general. Most of the tools listed do pretty easily solve certain problems; however how those easily solved problems relate to the undefined problem is apparently inadequate. That is not the fault of the tools. Also it is not an exhaustive list of all possible techs/tools. Perhaps the topic he has not googled for yet which meets the unspecified goal is "SSL certs" or "SSH host keys in DNSSEC secured zones".
Without a defined goal, rudderless drifting is unavoidable. This applies to a lot more than computational system designs.
Reading between the lines and doing some creative writing about something I find interesting, I am guessing what he's asking for is some kind of mandatory peer review/code audit of git commits aka the dude who writes code is never allowed to merge the code, at minimum, and the dude who writes unit tests is never allowed to write code, and all devs have to be in the "big" GPG WoT off a major public keyserver not just one little project. Because I have no idea what problem he's trying to solve, this particular solution to a problem, although somewhat interesting, may not have anything to do with his actual goal.
The irony is hilarious because there is at least some disagreement on what the "Holy Grail" really is, outside this discussion. So yes, "Package signing is not the Holy Grail" because we have no idea what the Holy Grail Really Is both archeologically/historically and WRT python package distribution. Maybe both are just a coffee cup.
This isn't even a defined problem, much less solved or easily solved. A goal would help a lot. I searched the article and the comments for the word "goal" and found nothing. It is an OK laundry list of several tools and techniques and their strengths and weaknesses in general. Most of the tools listed do pretty easily solve certain problems; however how those easily solved problems relate to the undefined problem is apparently inadequate. That is not the fault of the tools. Also it is not an exhaustive list of all possible techs/tools. Perhaps the topic he has not googled for yet which meets the unspecified goal is "SSL certs" or "SSH host keys in DNSSEC secured zones".
Without a defined goal, rudderless drifting is unavoidable. This applies to a lot more than computational system designs.
Reading between the lines and doing some creative writing about something I find interesting, I am guessing what he's asking for is some kind of mandatory peer review/code audit of git commits aka the dude who writes code is never allowed to merge the code, at minimum, and the dude who writes unit tests is never allowed to write code, and all devs have to be in the "big" GPG WoT off a major public keyserver not just one little project. Because I have no idea what problem he's trying to solve, this particular solution to a problem, although somewhat interesting, may not have anything to do with his actual goal.
The irony is hilarious because there is at least some disagreement on what the "Holy Grail" really is, outside this discussion. So yes, "Package signing is not the Holy Grail" because we have no idea what the Holy Grail Really Is both archeologically/historically and WRT python package distribution. Maybe both are just a coffee cup.