Received-SPF: pass (sog-mx-1.v43.ch3.sourceforge.com: domain of petertodd.org
	designates 62.13.149.113 as permitted sender)
	client-ip=62.13.149.113; envelope-from=pete@petertodd.org;
	helo=outmail149113.authsmtp.com; 
Date: Sat, 23 Aug 2014 10:32:15 -0400
From: Peter Todd <pete@petertodd.org>
To: Troy Benjegerdes <hozer@hozed.org>
Message-ID: <20140823143215.GA18452@savin.petertodd.org>
References: <CAJHLa0NXAYh9HzazN6gArUV8y7J8_G0oqkZqPBgibpW0wRNxKQ@mail.gmail.com>
	<2302927.fMx0I5lQth@1337h4x0r>
	<20140823061701.GQ22640@nl.grid.coop>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="y0ulUmNC+osPPQO6"
Content-Disposition: inline
In-Reply-To: <20140823061701.GQ22640@nl.grid.coop>
User-Agent: Mutt/1.5.21 (2010-09-15)
Cc: bitcoin-development@lists.sourceforge.net
Subject: Re: [Bitcoin-development] Reconsidering github
Precedence: list


--y0ulUmNC+osPPQO6
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sat, Aug 23, 2014 at 01:17:01AM -0500, Troy Benjegerdes wrote:
> This is why I clone git to mercurial, which is generally designed around =
the
> assumption that history is immutable. You can't rewrite blockchain histor=
y,
> and we should not be re-writing (rebasing) commit history either.

Git commits serve two purposes: recording public history and
communication.  While for the purpose of recording history immutable
commits make sense, for the purpose of communicating to other developers
what changes should be added to that history you *do* want the mutable
commits that git's rebase functionality supports. Much like how
university math classes essentially never teach calculus in the order it
was developed, it is rare indeed for the way you happened to develop
some functionality to be the best sequence of changes for other
developers to understand why and what is being changed.

Anyway, just because mercurial is designed around the assumption that
commit history is immutable doesn't mean it actually is; an attacker can
fake a series of mercurial commits just as easily as they can git
commits. The only thing that protects against history rewriting is
signed commits and timestamps.


> The problem with github is it's too tempting to look at the *web page*, w=
hich=20
> is NOT pgp-signed, and hit the 'approve' button when you might have someo=
ne
> in the middle approving an unsigned changeset because you're in a hurry to
> get the latest new critical OpenSSL 0day security patch build released.
>=20
> We need multiple redundant 'master' repositories run by different people =
in
> different jurisdictions that get updated on different schedules, and have=
 all
> of these people pay attention to operational security, and not just outso=
urce
> it all to github because it's convenient.

The easiest and most useful way to achieve that would be to have a
formal program of code review, perhaps on a per-release basis, that
reviewed the diffs between the previous release and the new one. Master
repos in this scenario are simply copies of the "master master" repo
that someone has manually verified and signed-off on, with of course a
PGP signature.

If you feel like volunteering to maintain one of these repos, you may
find my Litecoin v0.8.3.7 audit report to be a useful template:

https://bitcointalk.org/index.php?topic=3D265582.0

--=20
'peter'[:-1]@petertodd.org
0000000000000000284b07a00c97e4770dda4dee8b45994440226435ee05ab66

--y0ulUmNC+osPPQO6
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----

iQGrBAEBCACVBQJT+KXpXhSAAAAAABUAQGJsb2NraGFzaEBiaXRjb2luLm9yZzAw
MDAwMDAwMDAwMDAwMDAyODRiMDdhMDBjOTdlNDc3MGRkYTRkZWU4YjQ1OTk0NDQw
MjI2NDM1ZWUwNWFiNjYvFIAAAAAAFQARcGthLWFkZHJlc3NAZ251cGcub3JncGV0
ZUBwZXRlcnRvZC5vcmcACgkQJIFAPaXwkfs5HQf/USD5IrkYNK+ObJO74aHXxW0e
SHOksPZbE4GIGMjXG+qAshGJt7dPuopbeO1TdVmmY/frq8rdW3fgtMzbEv0y7ESi
eCDpwook0YQC8Z7aBKwQFzYelWOyprvIHyGtR058TyxsqBOCHvqn5TI3zxAl8g8N
11VWmLZ5xfQULFvtDFk8mX3TXSkg8Ke5ZQBdrQuTFIne0UjfAuELddqBXMZyPOow
QdsXzmY0+RpqV8vgoU8RddYvqlx/8qGLdi+tdj+TuRVPGN041suHhFHU5ysLL2ow
CHE573o+w+MLMFhd9FOR2L0ENOArppk5hXzSofW6o0xuGNJCC3QXof6Z9mkr6g==
=8oGm
-----END PGP SIGNATURE-----

--y0ulUmNC+osPPQO6--