🚀 go-pugleaf

a_rubin@dsg4.dse.beckman.com (Arthur Rubin) writes:

>>strategic plan involving the use of business B's software.  A wants to
>>be protected in case of B's possible bankruptcy, and so they insist that
>>the source code be encrypted, with the decryption key deposited somewhere
>>safe.
>
>...
>
>Why not just deposit the source code with the trusted depository?

Let's say my firm, Beta Software, contracts with Acme Disaster Recovery
Services for off-site archival storage of the source code.  Every time 
we revise the code, we send an encrypted copy to Acme.  The decryption
key is held by a trustee, an independent accountant.  

At some point, the company which is purchasing our source code desires 
an audit.  They want to know if all that encrypted stuff being held by
Acme is really up-to-date source code.  The accountant can decrypt what
Acme is holding, but can he tell whether it is the real thing?  Is he
willing to sign a certificate to that effect?

If the source code is signed by an executive of the software firm, then
the executive has the liability for the genuineness of the code, and the
accountant has the liability for the genuineness of the signature.  So
how does the accountant verify the signature?  



-- 
Robert Ames mirage1@gpu.utcs.utoronto.ca  P.O. Box 724, Station 'A', Toronto