Hi,
I had a few doubts regarding the project, I din't see any reply on mm-dev so I mailed separately. Firstly what address should be used to create the keys for the lists? I was of the opinion that list' posting address should be used like 'mailman-developers@python.org' for mm-dev list. Steve had opinion that keys should be associated with people rather than bots so the address should be '$LIST-owner@fooo' type. Any thoughts??
Also Barry while running tests I see a few tests are failing because now simple message will not be able to pass the 'default-posting-chain' and 'multipart/signed' is requred. So should I change all the tests?
Abhilash Raj
Hi,
I had a few doubts regarding the project, I din't see any reply on mm-dev so I mailed separately. Firstly what address should be used to create the keys for the lists? I was of the opinion that list' posting address should be used like 'mailman-developers@python.org' for mm-dev list. Steve had opinion that keys should be associated with people rather than bots so the address should be '$LIST-owner@fooo' type. Any thoughts??
Definitely the address of the list.
PGP support of MUAs uses the recipient's mail address for looking up the corresponding key. Not using the list address in the list key will break this assumption and make manual steps for each list post necessary.
Stefan.
On Aug 18, 2013, at 04:43 PM, Abhilash Raj wrote:
I had a few doubts regarding the project, I din't see any reply on mm-dev so I mailed separately. Firstly what address should be used to create the keys for the lists? I was of the opinion that list' posting address should be used like 'mailman-developers@python.org' for mm-dev list. Steve had opinion that keys should be associated with people rather than bots so the address should be '$LIST-owner@fooo' type. Any thoughts??
If I read the correct response from Steve, I don't think he was adamant about it. He basically said that he associates keys more with people than bots, but OTOH, -owner isn't really a person. I don't think using -owner is what folks would normally expect, so I think the posting address makes the most sense.
(Would it be possible to use the list-id or does it have to be an actual email address? list-id is considered more stable than posting address.)
Also Barry while running tests I see a few tests are failing because now simple message will not be able to pass the 'default-posting-chain' and 'multipart/signed' is requred. So should I change all the tests?
The test suite is a mess right now. The latest updates to various zope libraries have broken things for me. I am working on a branch to switch to a standard-ish virtualenv + nose{1,2} setup, which will include ensuring the test suite works again, at least for SQLite. Vacation schedules have delayed this a bit.
-Barry
Barry Warsaw writes:
If I read the correct response from Steve, I don't think he was adamant about it. He basically said that he associates keys more with people than bots, but OTOH, -owner isn't really a person. I don't think using -owner is what folks would normally expect, so I think the posting address makes the most sense.
I agree now. The point made in an earlier post is that in most cases people will use their keyrings to store keys, and addresses are the most stable way among human-readable key specifiers to access the keyring. Eg, suppose you're replying to me; my display name in this message won't help you find my key unless your MUA's parser is *very* "sophisticated" (ie, makes dangerous guesses).
(Would it be possible to use the list-id or does it have to be an actual email address? list-id is considered more stable than posting address.)
List-Id could be used, but do you really think that anybody but larsi would implement fishing it out of the header and using it as the user name in a keyring? ;-)[1] This would also violate PKI user's expectations about the stability of names, slightly. Use of display names to access keyrings is normally interactive because a person can get that right -- she may remember the display name in the key for some reason, or use a partial-match accessor. Programs won't (well, maybe Prism would, but let's hope Prism doesn't have our keys at all!), but they will have immediate access to something that *can't* be misspelled and still be useful (ie, the email address).
Also Barry while running tests I see a few tests are failing because now simple message will not be able to pass the 'default-posting-chain' and 'multipart/signed' is requred. So should I change all the tests?
The test suite is a mess right now.
Translated into pragmatic terms: Don't bother fixing the leaky roof because Barry's about to bulldoze the house. VCS implication: your branch will have hard-to-fix conflicts throughout the test suite.
Footnotes: [1] Lars "larsi" Ingebrittsen is the main developer of the Gnus MUA for Emacs, known for implementing features first (the IETF thanks you) and for much-too-clever code.
On Aug 20, 2013, at 11:52 AM, Stephen 'Humble is my middle name' Turnbull wrote:
Actually, it seems like "Humble is my middle name" is your middle name. :)
I agree now. The point made in an earlier post is that in most cases people will use their keyrings to store keys, and addresses are the most stable way among human-readable key specifiers to access the keyring. Eg, suppose you're replying to me; my display name in this message won't help you find my key unless your MUA's parser is *very* "sophisticated" (ie, makes dangerous guesses).
Agreed.
The test suite is a mess right now.
Translated into pragmatic terms: Don't bother fixing the leaky roof because Barry's about to bulldoze the house. VCS implication: your branch will have hard-to-fix conflicts throughout the test suite.
We'll see, but I'm hopeful now that it may not be so bad. My first branch using nose was brutal, but nose2 has support for zope.testing-ish layers. I haven't gotten the doctests working yet, but everything else seems to have gone quite smoothly with few changes to the code.
-Barry
Barry Warsaw writes:
We'll see, but I'm hopeful now that it may not be so bad. My first branch using nose was brutal, but nose2 has support for zope.testing-ish layers. I haven't gotten the doctests working yet, but everything else seems to have gone quite smoothly with few changes to the code.
That's good news! Still, there's no point in either of you making work for the other by messing with the tests at the same time.
On 08/19/2013 10:52 PM, Stephen 'Humble is my middle name' Turnbull wrote:
Barry Warsaw writes:
If I read the correct response from Steve, I don't think he was adamant about it. He basically said that he associates keys more with people than bots, but OTOH, -owner isn't really a person. I don't think using -owner is what folks would normally expect, so I think the posting address makes the most sense.
I agree now. The point made in an earlier post is that in most cases people will use their keyrings to store keys, and addresses are the most stable way among human-readable key specifiers to access the keyring. Eg, suppose you're replying to me; my display name in this message won't help you find my key unless your MUA's parser is *very* "sophisticated" (ie, makes dangerous guesses).
fwiw, i also agree with the earlier commenters that the list's e-mail address is the appropriate address for the list key's User ID. that's what's used in every schleuder list that i've ever seen as well, fwiw.
In some future iteration, you may also want to bind foo-request@example.net as an additional user ID (to the same key, probably), but i don't think that will be relevant for this iteration.
[1] Lars "larsi" Ingebrittsen is the main developer of the Gnus MUA for Emacs, known for implementing features first (the IETF thanks you) and for much-too-clever code.
larsi is also the mad genius responsible for most of gmane.org, for which many of us are very grateful :)
--dkgOn Aug 21, 2013, at 12:42 PM, Daniel Kahn Gillmor wrote:
larsi is also the mad genius responsible for most of gmane.org, for which many of us are very grateful :)
I hope at some point we'll have a plugin to allow for direct integration with Gmane (e.g. register-this-list, an IArchiver to feed it directly).
Gmane is a *life-saver*!
-Barry
participants (6)
-
Abhilash Raj -
Barry Warsaw -
Daniel Kahn Gillmor -
Stefan Schlott -
Stephen 'Humble is my middle name' Turnbull -
Stephen J. Turnbull