Re: Announcing Bellcore's Trusted Software Integrity (Betsi) System

>>   -  provide accountability by linking the author of a program
>>      to a real person whose identity is verified off-line 
>
>This is unnecessary, and I would claim undesirable.  A unique anonymous
> ID is just as good as a "real" one -- since you're relying upon PGP
> anyway, the mapping from signature to a known identity is one-to-one.
>
>The only reason I can see to require this "real human" mapping is
> to try to prosecute people for bugs in their code or some contamination
> that seeps into their release.
>
>That's not an aspect of the world I want to live in.

Or to warn potential virus "authors" that *their* anonymity is no longer 
assured - not a bad thing. Not enough to justify the rest of it, IMHO, but 
certainly not Evil Incarnate (not to be flinging misinterpretations or 
aspersions :-)

Dave Merriman
- - - - - - - - - - - - - - - - - - - - - - - - - - 
Finger merriman@metronet.com for PGP/RIPEM public keys and fingerprints. 
Unencrypted Email may be ignored without notice to sender.  PGP preferred.
Remember: It is not enough to _obey_ Big Brother; you must also learn to 
*love* Big Brother.

brains@male.org writes:
 > Or to warn potential virus "authors" that *their* anonymity is no longer 
 > assured - not a bad thing. Not enough to justify the rest of it, IMHO, but 
 > certainly not Evil Incarnate (not to be flinging misinterpretations or 
 > aspersions :-)

Certainly not enough to justify the rest: Can you name one example of an
 author of a package including some virus?  Not someone putting one
 post-production (individual signing will prevent that), but the original
 author?

It's a straw man.
--
L. Todd Masco  | "Which part of 'shall not be infringed' didn't
cactus@bb.com  |   you understand?"

> "L. Todd Masco" <cactus@bibliob.slip.netcom.com> writes:
> Certainly not enough to justify the rest: Can you name one example of an
> author of a package including some virus?  Not someone putting one

Yes.

> post-production (individual signing will prevent that), but the original
> author?

Mark Ludwig wrote KOH, an on-the-fly disk encryption program that is also
a virus.  It was posted recently to alt.security.pgp.  Ludwig is the author
of a number of other viruses that don't claim to be useful.

> It's a straw man.

OK.  For the record, I think it's a Good Thing to have as much confidence
in lots of different frequent-version programs as I do in (say) PGP with
its signed-file protocols.

	Jim Gillogly
	Hevensday, 7 Halimath S.R. 1994, 22:32

Jim Gillogly writes:
 > Mark Ludwig wrote KOH, an on-the-fly disk encryption program that is also
 > a virus.  It was posted recently to alt.security.pgp.  Ludwig is the author
 > of a number of other viruses that don't claim to be useful.

I stand corrected;  However, my point (overstated as it was) is that this
 is insignificant to the total number of programs distributed: the whole
 mass of ftp.uu.net, wuarchive.wustl.edu,...

> OK.  For the record, I think it's a Good Thing to have as much confidence
> in lots of different frequent-version programs as I do in (say) PGP with
> its signed-file protocols.

Oh, I certainly agree.  I just don't believe that Betsi does anything
 constructive towards this -- doing this through reputations of known
 agents is a much better method, IMO -- and not one that requires an
 agent <-> human mapping.
--
L. Todd Masco  | "Which part of 'shall not be infringed' didn't
cactus@bb.com  |   you understand?"

> Certainly not enough to justify the rest: Can you name one example of an
>  author of a package including some virus?  Not someone putting one
>  post-production (individual signing will prevent that), but the original
>  author?

Many Mac viruses that I've seen come straight from Microsoft neatly
sealed in plastic on brand new disks.  If they signed them it would
not increase my confidence one iota.


brad

Brad Huntting writes:
 > Many Mac viruses that I've seen come straight from Microsoft neatly
 > sealed in plastic on brand new disks.  If they signed them it would
 > not increase my confidence one iota.

How would getting Betsi to sign them increase your confidence?  Betsi
 doesn't seem to claim to do any testing of the software, they just
 verify that it was really Bill Gates' company (in this example) that
 shipped the Microsoft product.  BFD -- they can buy their own ViaCrypt
 PGP.

I think people are missing my point: that having a third party sign
 your software without any testing (Betsi is free, after all) adds
 *nothing* except for a human-to-name mapping, and increases the
 risk of the signature being compromised.

Now, there probably is a market for somebody who tests the software
 first and then certifies it -- in fact, that will probably be a big
 business in the future, one I can easily see someone like Cygnus getting
 into.  But that's not what Betsi claims to do, and I certainly don't
 want to contemplate the legal issues (do you get your ass sued off when
 you're wrong?  Almost certainly) involved with anybody trying to do that.
--
L. Todd Masco  | "Which part of 'shall not be infringed' didn't
cactus@bb.com  |   you understand?"