RE: xeta security model, and hello

Hello,

Just to clear up a little misunderstanding, the URL you forward here
contains a description of the task I gave to James Harlow. We are still
waiting in awe to see what he comes up with. :)

Now, if I understand your comment right, you are proposing a scheme that is
dependent on data, the build recipes that we call XBuilds, being stored in a
certain fixed form. An architectural goal for Xeta has been that these data
should be able to reside anywhere and possibly in a multitude of formats. As
such, we do not demand that data is stored in a single monolithic tree of
files like portage does. We don't even demand that an XBuild is a file.
Calculating message digests then suddenly becomes hard. Not impossible, but
hard. 
Anyway, we'll wait for James to complete his task. Maybe I even
misunderstood your comments altogether... 

Best regards
Frantz Dhin, Zynot Foundation


-----Original Message-----
From: [email protected] [mailto:[email protected]] On
Behalf Of Chris Frey
Sent: 28. oktober 2003 22:32
To: [email protected]
Subject: xeta security model, and hello

Hi there,

Just heard of this project last night, and was pleased to discover that
you're focusing on the embedded space, and that you're open to securing
the portage tree and the tools used to access them.

I was reading the proposed security model at
http://wiki.zynot.org/tiki/tiki-read_article.php?articleId=30
and have some comments.

It sounds like the security model is more based on SSH or SSL-like
transports than GPG signing of the tree itself.  In my opinion, if you
do the GPG signing, a lot of the problems that SSH and SSL solve
are solved already.

It won't matter where the user gets the tree, since it is signed.  As long
as he has the proper key (which SSH/SSL can help with downloading), the
mirrors could be compromised and he'd still be safe.

If I've misunderstood the entire goal and purpose, I apologise.  Just
thought
I'd add my $0.02.

- Chris

_______________________________________________
Xeta mailing list
[email protected]
http://lists.zynot.org/mailman/listinfo/xeta