From: Lennon Day-Reynolds <rcoder@...>
Date: 2004-06-26T01:53:27+09:00
Subject: Re: rubygems thoughts

Why not just use the public-key system already build into SSH/SCP/SFTP
to authenticate the package maintainers' uploads? Since presumably
each repository would have some sort of access controls on uploads,
you could just require each new contributor to generate a key for
access to the repository, and transfer it to the administrator(s) for
installation on the hosting system. Then, SFTP transfers become
password-less for the packager, (since their key is already installed
on the hosting machine) while still authenticating each upload.

Signing each package, while valuable in term of ensuring maximum
security, could also be just as significant a bottleneck for adoption
and use of packages due to the need to acquire and trust a potentially
large number of public keys (i.e., one per author). Building effective
public key infrastructure has been tried many times before, and while
there are some small groups in which it works, many more have found
that the effort required to induct new members into the "web of
trust," or even to adjust to normal occurances like lost keys, simply
made it too difficult to maintain.

It's not that I'm trying to say that PKI is a bad idea; personally, I
wish that everyone I knew had PGP keys, and that signing, at least (if
not outright encrypting) personal communications and documents were
just considered standard practice. Unfortunately, even among the more
tech-savvy people I know, tools like standard FTP and unencrypted
webmail access are all too common.

I also want to make the repository admin's job as easy as possible,
but having that single key for the repository, rather than one for
every package author, greatly simplifies the key management for
end-users. In reducing the number of keys that have to be verified and
stored, it also could make the entire system more, rather than less,
secure, as the chances of getting a fake key for one of the the main
repositories would be greatly reduced by their increased profile.
Major, coordinated efforts would be necessary to alter the keys of any
major repository, as it could be easily mirrored at any number of
locations for verification.

Lennon