🚀 go-pugleaf

In <1993Jan8.155007.16181@csi.uottawa.ca> cbbrowne@csi.uottawa.ca (Christopher Browne) writes:

>In article <C0IFAw.3vy@bcstec.ca.boeing.com> vanzwol@bcstec.ca.boeing.com (Ted Van Zwol) writes:
>>This intrigues me.  I'm not accusing you (Peter) of anything, but consider:
>>
>>How do we know the PGP sources on alt.sources (or even that on any FTP site
>>for that matter) are "safe".  What kind of precautions or checks exist to
>>prevent bogus code from cropping up.  Why couldn't some intelligence agency
>>get their hands on the code and weaken the encryption algorithm just enough
>>for them and then distribute the modified source to the rest of the world.
>>
>>I haven't looked at the source or the comments myself, so I don't know if
>>this is already addressed.  But, it concerns me.  Who's to say the copies of
>>PGP available are trustworthy?  I'm terribly confused...

>The best idea would probably be to have an MD5 signature of (say) the actual
>text of each post appended to the end.  Said signatures could then be
>published either in:
>a) sci.crypt
>b) Some moderated newsgroup?
>c) The C Users Group magazine?

>or somewhere such.

I thought of clear-signing the post with PGP, but then decided against it
since it would have involved shipping the entire thing home to sign (I won't
use PGP on a multiuser system) and back again, and would have almost
certainly screwed up the automatic unsharing process.  Unfortunately until
there's some organised way of authenticating postings (eg PEM or the
equivalent functionality in PGP) there isn't any easy way to authenticate
the posting.

(On the other hand I doubt very much whether the NZ govt could be bothered
messing around with usenet postings, and if there were discrepancies
caused by mainpulation on non-NZ sites it would probably be discovered
pretty quickly when differing versions of the code were found floating
around).

Peter.
--
 pgut1@cs.aukuni.ac.nz||p_gutmann@cs.aukuni.ac.nz||gutmann_p@kosmos.wcc.govt.nz
peterg@kcbbs.gen.nz||peter@nacjack.gen.nz||peter@phlarnschlorpht.nacjack.gen.nz
              (In order of preference - one of 'ems bound to work)
           -- Whoever dies with the most email addresses ... wins --