From: "Aleksi Niemelä" <aleksi.niemela@...>
Date: 2000-07-04T19:02:03+02:00
Subject: [ruby-talk:03803] Re: Ubiquitous Ruby

> > > In terms of security, I agree there are issues here, but not
> > > insurmountable ones. We'll need to involve crypto folks in this.
> > 
> > not neccessarily.  standard pgp-encryption would suffice, it's the
> > "trusted source" which could be a problem, in the face of mirroring
> > needs.
> 
> Isn't that vulnerable to man-in-the-middle, though? I'm not an expert
> here, just guessing.

Yes it is. Look my mail [ruby-talk:3800]. If there're some man-in-the-middle
who both distant parties know, we can create a web of trust. And once we've
created a start it should be quite easy to grow. When few people really know
each other (not likely in this small community) and the trust isn't based on
one positive check, it's quite hard to munge in afterwards. 

OTOH, the fact that Ruby, in it's current shape, isn't attractive for
malicious users is quite reliefing. There simply isn't anything to gain.
Once we have working infrastructure and web of trust in place, and Ruby
advances, there might be some distant potential that there exists some weird
value for someone to pretend to be someone else.

	- Aleksi