Path: csiph.com!usenet.pasdenom.info!news.redatomik.org!newsfeed.xs4all.nl!newsfeed2a.news.xs4all.nl!xs4all!post.news.xs4all.nl!not-for-mail
Return-Path: <rosuav@gmail.com>
X-Original-To: python-list@python.org
Delivered-To: python-list@mail.python.org
X-Spam-Status: OK 0.047
X-Spam-Evidence: '*H*': 0.91; '*S*': 0.00; 'subject:Python': 0.05; '(so': 0.07; 'agree,': 0.09; 'governments': 0.09; 'cc:addr:python- list': 0.10; '(say': 0.16; '*any*': 0.16; '24,': 0.16; 'benefit.': 0.16; 'certificate.': 0.16; 'entities.': 0.16; 'from:addr:rosuav': 0.16; 'from:name:chris angelico': 0.16; 'idea:': 0.16; 'valid.': 0.16; 'wrote:': 0.16; "wouldn't": 0.16; '>>>': 0.20; 'cc:2**0': 0.21; 'cc:addr:python.org': 0.21; 'saying': 0.22; 'dropped': 0.22; 'voting': 0.22; 'am,': 0.23; '2015': 0.23; 'sat,': 0.23; 'header :In-Reply-To:1': 0.24; 'question': 0.26; 'respective': 0.27; 'message-id:@mail.gmail.com': 0.28; 'currently,': 0.29; 'subject:other': 0.29; 'no,': 0.29; 'subject:all': 0.32; "d'aprano": 0.33; 'european': 0.33; 'steven': 0.33; 'this?': 0.34; 'received:google.com': 0.34; 'that,': 0.34; 'gives': 0.35; 'could': 0.35; 'charge': 0.36; 'but': 0.36; 'being': 0.36; 'others.': 0.36; 'should': 0.37; 'subject:: ': 0.37; 'say': 0.38; 'means': 0.39; 'pm,': 0.39; 'takes': 0.39; 'where': 0.40; 'some': 0.40; 'your': 0.60; 'gave': 0.63; 'delegate': 0.66; 'situation': 0.67; 'risk': 0.67; 'power': 0.72; 'country': 0.74; 'subject:have': 0.80; 'chrisa': 0.84; 'uncertain': 0.84; 'veto': 0.84; 'subject:you': 0.88; 'to:none': 0.90; 'refuse': 0.93; 'russia': 0.93; 'states,': 0.93; 'union.': 0.93; 'authorities': 0.95
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:cc :content-type; bh=q4R+cnoyaclCyK9P3YbySXHAJigX7DLjdNFWerv2Rfs=; b=nXtq0FPIeJNkj3SKHR1ckCxuMDAqKlMENIIQXiyb+mLihVdYrewD6F4wShWmnsGLoN 3Zgh90U227o6A/Y4Rs5bnCX96Nhe58LPbquHhrZPFyaqZqfL/3sUMBa8fafeEjc9JIyY L+lN8ez8TG6pPZnNRtWZrCQPMZZfEs9ZJWOywAsf8zGn2D8tsn9OpTm0ly44y5Wo5ldE GCLEBL3XwE8kWGsdZMZ+mIGZBwvfpuE15uIF2k7PHdHQTKEkc3xbE7HOqAWquC0o4u5E 9Y0kCSyJsIJuPx5nU+gzJGOf/0wr/MnhQ4w/H4lOB8yEe5Aj228642Opl5TGFgpF20Bt eMfA==
MIME-Version: 1.0
X-Received: by 10.50.61.229 with SMTP id t5mr13201638igr.34.1432402909144; Sat, 23 May 2015 10:41:49 -0700 (PDT)
In-Reply-To: <87siankzfk.fsf@elektro.pacujo.net>
References: <555f440a$0$12990$c3e8da3$5496439d@news.astraweb.com> <mailman.222.1432309028.17265.python-list@python.org> <555FA253.3020304@tundraware.com> <mjomke$saf$1@ger.gmane.org> <mailman.252.1432352224.17265.python-list@python.org> <mjp88e$e1$1@news.albasani.net> <87382nmpkd.fsf@elektro.pacujo.net> <556087ee$0$13004$c3e8da3$5496439d@news.astraweb.com> <87siankzfk.fsf@elektro.pacujo.net>
Date: Sun, 24 May 2015 03:41:48 +1000
Subject: Re: Ah Python, you have spoiled me for all other languages
From: Chris Angelico <rosuav@gmail.com>
Cc: "python-list@python.org" <python-list@python.org>
Content-Type: text/plain; charset=UTF-8
X-BeenThere: python-list@python.org
X-Mailman-Version: 2.1.20+
Precedence: list
List-Id: General discussion list for the Python programming language <python-list.python.org>
List-Unsubscribe: <https://mail.python.org/mailman/options/python-list>, <mailto:python-list-request@python.org?subject=unsubscribe>
List-Archive: <http://mail.python.org/pipermail/python-list/>
List-Post: <mailto:python-list@python.org>
List-Help: <mailto:python-list-request@python.org?subject=help>
List-Subscribe: <https://mail.python.org/mailman/listinfo/python-list>, <mailto:python-list-request@python.org?subject=subscribe>
Newsgroups: comp.lang.python
Message-ID: <mailman.284.1432403395.17265.python-list@python.org>
Lines: 36
NNTP-Posting-Host: 2001:888:2000:d::a6
X-Trace: 1432403395 news.xs4all.nl 2936 [2001:888:2000:d::a6]:50333
X-Complaints-To: abuse@xs4all.nl
Xref: csiph.com comp.lang.python:91144

On Sun, May 24, 2015 at 2:53 AM, Marko Rauhamaa <marko@pacujo.net> wrote:
> Steven D'Aprano <steve@pearwood.info>:
>
>> On Sat, 23 May 2015 10:44 pm, Marko Rauhamaa wrote:
>>> Here's an idea: an authentication is considered valid if it is
>>> vouched for by the United States, China, Russia *and* the European
>>> Union. Those governments are the only entities that would have the
>>> right to delegate their respective certification powers to private
>>> entities.
>>
>> If you gave them veto power over all certificate authorities (since
>> you need all four to agree, any of them can veto a CA),
>
> No, they wouldn't be able to veto a CA. At worst, they would be able to
> refuse you a certificate. If they did that, they would risk being
> dropped from the power pool.

You start out by saying it's valid if vouched for by X, Y, Z., *and*
A. That means that if it's vouched for by X, Y, and A, but not Z, then
it's not valid. That gives Z the power to veto any certificate.
Correspondingly each of the others.

Alternatively, you could say that it's valid if vouched for by *any*
of your authorities... but then you have the same situation as
currently, where multiple authorities can create identical
certificates.

You could try for some kind of voting scheme, where it takes X/2+1
authorities to create a certificate (so you'd need three of your four,
or if you added a fifth (say Japan), then three out of the five); but
this just entails ridiculous overheads for uncertain benefit.

Also, there's one huge question outstanding: Since when should country
governments and the EU be in charge of any of this?

ChrisA