Experimental Physics and
Industrial Control System

[email protected] (Alan K Biocca) · Tue, 14 Feb 95 08:37:40 PST

> From [email protected]  Tue Feb 14 01:15:15 1995
> 
> At the consortium meeting I suggested distribution via CDs.  This was 
> considered too expensive.  In the light of the new concerns about 
> security,  is this cost now overshadowed by the secure method of 
> distribution that it offers?

Perhaps more important than cost is timeliness - the distribution needs to 
be tweaked too often to produce cdroms.  Who would want to wait for the
'final' tweak, and then wait another N weeks for production and transportation..
We normally get started with an early version and then incorporate the final
later.  This would make for many cdrom versions.  Cdrom is excellent for
infrequent releases of stable products to large audiences.  Our audience is
small - production costs are high until a thousand or more
are molded in a run...

I think we should combine suggestions and provide a three-pronged approach:

1) Use an ftp site with an account/password (this minimizes the number of
   copies of the encrypted tarfiles floating about) AND

2) Encrypt with PGP -c (normal private key encryption), handling keys
   by off-net channels to a minimum set of individuals who have signed
   non-disclosure agreements on the keys and source.

   Remember that the need to keep the key secure is exactly the same as
   keeping the source distribution secure.  If it is relatively difficult
   to get the encrypted distribution the key alone is not useful.

3) For those sites who don't or can't handle the encryption, put an
   exebyte in the mail, or setup a special account and password and
   then break it down as soon as they have downloaded.  This is still
   weak since snooping the download is not difficult.

Alan K Biocca

Experimental Physics and Industrial Control System

Experimental Physics and
Industrial Control System