<div><span style="color: rgb(160, 160, 168); ">On Tuesday, April 17, 2012 at 9:45 AM, martin@v.loewis.de wrote:</span></div>
<blockquote type="cite" style="border-left-style:solid;border-width:1px;margin-left:0px;padding-left:10px;">
<span><div><div><blockquote type="cite"><div><div>So you were updating a directory but serving another directory ?</div><div><br></div><div>But then updating the right last-modified page people were seeing ?</div></div></blockquote><div><br></div><div>It probably would have updated an unpublished last-modified as well.</div><div><br></div><div>For a similar issue, in appengine, I had duplicate File objects in the</div><div>database, and always served the one that GQL happened to return first.</div><div>In that case, both last-modified and the checksum might update correctly,</div><div>but still, the wrong file might get served.</div><div><br></div><blockquote type="cite"><div><div>I am not sure why we're having this discussion since it's </div><div>implementation details, but it's fun :)</div></div></blockquote><div><br></div><div>I'm still trying to prove my claim that it's not feasible to increase</div><div>the trustworthiness of a mirror by computing some kind of checksum.</div><div>If the mirror has some systematic or random error, it may well be that</div><div>the checksum is as-expected, yet the mirror is inconsistent.</div></div></div></span></blockquote><div>As I thought more about this, I think it is actually feasible. It's not feasible to</div><div>increase it to 100%, but in this case, assuming a bug over malevolence, the</div><div>bug would have to affect both the updating of the last-modified and the checksum</div><div>generation.</div><div><br></div><div>It's essentially the same thing as asking another person to check over some work,</div><div>that person could miss something, or also be wrong, but it decreases the likelihood</div><div>by adding another piece of verification. </div><blockquote type="cite" style="border-left-style:solid;border-width:1px;margin-left:0px;padding-left:10px;"><span><div><div><div><br></div><blockquote type="cite"><div><div>If there's interest I can write a multiprocess-based script that </div><div>keeps a md5 database up-to-date</div></div></blockquote><div><br></div><div>That's besides the point. The question is whether doing so would practically</div><div>help to improve the consistency, and I believe the answer is: no. It may help</div><div>to increase people's trust (which is a subjective manner), which may be</div><div>worthwhile itself, but may also backfire if they download inconsistent files</div><div>despite the mirror giving "proof" that it is consistent.</div><div><br></div><div>Regards,</div><div>Martin</div><div><br></div><div><br></div><div>_______________________________________________</div><div>Catalog-SIG mailing list</div><div><a href="mailto:Catalog-SIG@python.org">Catalog-SIG@python.org</a></div><div><a href="http://mail.python.org/mailman/listinfo/catalog-sig">http://mail.python.org/mailman/listinfo/catalog-sig</a></div></div></div></span>
</blockquote>
<div>
<br>
</div>