190600+ entries in 1.385s
undata: asciilifeform: I'd not mind if you hurried up making
a computer that works for me :D
undata is in progress haggling
a new computer out of lenovo
mircea_popescu: thus accomplishing more than western europe + north america, by
a damned sight.
decimation: or email address, that we can't penetrate that, that's
a problem.""
cazalla: ah, clearly i gots to learn the new assbot rules, been
a little busy
cazalla: rate Rozal -3 threatened to rate me -10 because he doesn't understand how the WoT actually works, see
http://pastebin.com/PABNbsex for conversation, offered to then pay me to remove the -1 earning him
a -3
mircea_popescu: w.b-
a.link/trust/7C1FBEC924FBD66531A02AE3F95E4E395927DC9C/FC66C0C5D98C42A1D4A98B6B42F9985AFAB953C4/json
undata: asciilifeform: still seems father would sign
a public statement granting his possessions to
a son
davout: asciilifeform: also if you see
a message signed with your key, and timestamped 200 years after your first timestamped message you can reasonably assumed it's been broken
mircea_popescu: asciilifeform no but suppose your 4kb key is factorized. this matter is discovered by joe on june 19th, 3211. he signs, with his 64kb key,
a note saying so.
davout: i just fail to see
a good reason to make the signatures mandatory, outside of access control that is
davout: say i want to timestamp
a contract i made with someone also in the L2 group as nested clearsigns, i doesn't really matter which signature is checked by deedbot, right?
davout: i don't really see
a use for that
PeterL: did it not have
a key before?
mircea_popescu: PeterL idea kinda is to make
a further record of people's sigs, help guard them against mitm and other nefariousness. but as davout points out, now the bot needs
a key.
davout: mircea_popescu: well, now the bot needs
a key too :-)
mircea_popescu: is "and pushes it to public repositories"
a point of contention ?
undata: mircea_popescu: I read the payment as coming from the party wanting
a signature, not the bot?
undata: keeps the published bundles down to
a size that is manageable
davout: we don't need Z to witness that X and Y signed
a contract together, because any party can and will use GPG
undata: or why one has it observed by
a 3rd party?
undata: do you know what
a deed is?
davout: why do you absolutely want to shoehorn your conception of
a notary into deedbot?
undata: have you ever been to
a notary?
undata: god... do the proceedings of court note that
a pidgeon shat on the window?
undata: davout: its output should be the history of valid deeds, not "that which
a rubber stamp has touched"
davout: undata: you fail to comprehend that it's not deedbot's job to certify to
a third party that the contract is signed by an identified party, gpg already does that
davout: anyway, my point wrt to deedbot is that it's supposed to be used by ppl with L1/L2 trust, it doesn't need to check gpg signatures, so let anyone with +v in -assets use it, do away with the requirement that
a keyid belonging to someone in assbot's wot be presented or maliciously hammered into the message
PeterL: would it be hard to maintain
a keyring with all us in it?
mircea_popescu: dude rms, you saved 24 bytes aren't you
a smart fucking cookie.
davout: gpg can't know the fpr for
a key it doesn't have, the information isn't part of the signature packet
davout: this sounds
a bit overkill to me
davout: the crux is 'verified keys', if deedbot doesn't maintain
a full keyring at all times it can't pull fingerprints
davout: s/for
a key/for
a sig/
davout: mircea_popescu: with the fingerprint for
a key it could simply do what you said wrt requesting trust data as
a json blob from the w.b-
a.link thing
davout: asciilifeform: well, keyid is
a part of the fpr afaik
mircea_popescu: apparently nobody heard of
a "shut.the.fuck.up.and.hire.cleaning.crew.cheapskates."
mircea_popescu: PeterL weren't you
a biochemist by trade dabbling into code as
a hobby recently ?
davout: by this account i'm
a core contributor to bitcoin too, i reset testnet once, fuck it
davout: ah, yea lol, i had
a look to see if this chick had any other commits on the project, seems like it's her sole 'contribution' to the whole thing
mircea_popescu: PeterL there's
a difference between the innocent and the stupid.
mircea_popescu: the "o look mom, i made
a github commit. it changes the spelling of comments" thing
mircea_popescu: davout everyone can now be
a "developer". even idiots.
nanotube: kakobrekla: i have no idea why i keep keyid as
a separate column in db either. probably something grandfathered in...
davout: well, if you want to pull off an attack on someone you'll want to get
a collision with
a specific key id
Apocalyptic: and that's just for
a preimage, if you want
a collision the birthday paradox will tell you that you need much less than that
Apocalyptic: 2**64 is well within reach of
a supercomputer
davout: that would be the number of distinct keyids, not sure how practically feasible it would be to bruteforce
a collision
gribble: Error: Something in there wasn't
a valid number.
davout: the signature verification would in this case (assuming both keys are in the keyring) yield both
a pass and
a fail, right?
davout: that doesn't make much sense to me, how would
a maliciously crafted pubkey even verify the signature?
davout: and i guess even in the case of
a keyid collision that has no impact on actual signature verification
undata: doesn't our agreement being public and with firm verification of identity bolster my claim among peers that you're
a knucklehead?
undata: davout: surely you understand that the wot quantifies what
a deed may provide historicity
undata: davout: what is the point of publishing
a scientific work in
a credible journal?
davout: lol, where does the spec even mention
a second party?
undata: whether it says inside "
A owes B his kidney" or "The sky is blue" both can be held to account that they have made the utterance by the existince of the thing
davout: look, there is
a reason it's called deedbot, and not notarybot, it's none of deedbot's business to know what happened, for all you know the notarized stuff could perfectly be encrypted
undata: or I'll go sit on
a park bench and call myself
a notary
undata: ^not
a valuable service
undata: davout:
a notary is not just
a person with
a clock and eyes
undata: davout: because no one ever once was opped in
a chan that shouldn't have been
davout: the thing is that, whatever turd comes along is necessarily given by someone who has voice in assets, so by very definition, not
a turd
undata: davout: isn't the whole point of
a notary verifying the identities of the parties involved then verifying that an agreement has taken place?
davout: kakobrekla: tbh if verifying the signature on notarized data is not considered necessary i don't think it's
a big issue if the dump is unsigned
davout: it still boils down to
a fpr <-> keyid mapping tho, not that this is evil _for this particular purpose_ but still
davout: kakobrekla: if
a 24h delay between asswot registration and ability to notarize is acceptable that would work