[PLUG] Re: BusinessWeek Article: Linux Inc

[Tom Diehl <tdiehl@rogueind.com>]

You said:

>Tom Diehl wrote:

>> <RANT>
>> Sorry for the lack of quoting. Quoting was lost due to the OP need
>> > to pgp sign a message to a public mailing list. Why I will never
>> understand but...
>> </RANT>
>
>Because, I think it's PRETTY?
>

Beauty is in the eyes of the beholder. :-)

>
>Not really.PGP has three primary uses:
>
>Confidentiality - When using encryption.

Not applicable here.

>Integrity - Has the message been changed in route?
>

In this case, as with most messages to this list, if the message
had changed there are other ways to verify the accuracy. 

>Authentication - Is this person who they say the are? Conversely,
>non-repudiation is included in this. Someone who signed a message
>can't say that they didn't send it since it is signed with their key.
>

Same answer as above.

>You could turn around, fabricate a story and say that someone hacked
>your email account add sent the above message without your knowing
>it. It's unsigned no one could prove otherwise. I can't; mine is
>signed. As are most of my messages in the archives of this list.

So if someone else sent the link to the list instead of me, I would have
been harmed how? Look at 99% of the information sent to this list.
Does it really matter who sent it??

>
>I could understand your complaint if it were about my sending an
>encrypted message to the list. That would be stupid.

We agree here.

>You CAN give me grief, however, about the fact that I double signed
>the message (which I try not to do). The message has an
>S/MIME sig that I usually don't send to mailing lists due to the size
>of S/MIME which sends a copy of the public with every message.

:-)

If there was information being posted here that it was important to
know exactly where it came from, then I would agree it should be signed.
However when someone posts information to a list like this, IMO the information
is what is important, not knowing the exact source. The link I furnished
earlier today is a classic point. Even if I signed the message you really
do not know who I am, yet you were able to verify the information I furnished
by actually looking at the link itself.

Just my $.02

Regards,

Tom Diehl		tdiehl@rogueind.com		Spamtrap address mtd123@rogueind.com
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug