Received-SPF: pass (sog-mx-3.v43.ch3.sourceforge.com: domain of gmail.com
	designates 209.85.219.52 as permitted sender)
	client-ip=209.85.219.52; envelope-from=mh.in.england@gmail.com;
	helo=mail-oa0-f52.google.com; 
MIME-Version: 1.0
Sender: mh.in.england@gmail.com
In-Reply-To: <20130507110740.GA10449@netbook.cypherspace.org>
References: <CANEZrP1YFCLmasOrdxdKDP1=x8nKuy06kGRqZwpnmnhe3-AroA@mail.gmail.com>
	<20130506161216.GA5193@petertodd.org>
	<CA+8xBpfdY7GsQiyrHuOG-MqXon0RGShpg2Yv-KeAXQ-503kAsA@mail.gmail.com>
	<20130506163732.GB5193@petertodd.org>
	<CANEZrP2WqXZVRJp6ag=RC4mSkt+a6qTYYpvE=DW_0Rdr=_BBHA@mail.gmail.com>
	<20130506180418.GA3797@netbook.cypherspace.org>
	<CAAS2fgSh+dYxSak8HvE0Sr4=zxzRc=3dMQ6X_nD_a+OdacUBZQ@mail.gmail.com>
	<20130506225146.GA6657@netbook.cypherspace.org>
	<CAAS2fgQU5yHFEUfzVwco=L2YKU=Ci0Od+4w59o1wx5UUf1w3VQ@mail.gmail.com>
	<CANEZrP1unq_36p0_VJ6CnHof2Sxb4B8go3BK6tPzEMbSLQBBtg@mail.gmail.com>
	<20130507110740.GA10449@netbook.cypherspace.org>
Date: Tue, 7 May 2013 14:04:16 +0200
Message-ID: <CANEZrP1HaOvSeh9RAoT5+Q=6w=TOqN79c1yTgcoL7z1H4X=yPg@mail.gmail.com>
From: Mike Hearn <mike@plan99.net>
To: Adam Back <adam@cypherspace.org>
Content-Type: text/plain; charset=UTF-8
Cc: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] limits of network hacking/netsplits (was:
	Discovery/addr packets)
Precedence: list

> And even without a PGP WoT connection, if the website had SSL enabled, they
> can trust the binaries its sending to the extent that it is securely
> maintained

Yes, it would be nice to have SSL but that requires finding
alternative file hosting.

> I guess its the least of the concerns but I believe Damgards is better.

Unfortunately we don't have any choice in what to use. There's no way
on Android to change the signing key after deployment, so we can
either split the existing key or do nothing.

There is a quorum-of-developers signing system using gitian and
reproducible builds, but as noted by Gregory, the problem is that
people don't check the signatures (even ignoring the web of trust
aspect which raises the complexity much higher). This sort of thing
works best when combined with an auto update engine or other kind of
software distribution platform.