[Mailman-Developers] Some Doubts for GSoC Project

[Stephen 'Humble is my middle name' Turnbull]

Barry Warsaw writes:

 > If I read the correct response from Steve, I don't think he was
 > adamant about it.  He basically said that he associates keys more
 > with people than bots, but OTOH, -owner isn't really a person.  I
 > don't think using -owner is what folks would normally expect, so I
 > think the posting address makes the most sense.

I agree now.  The point made in an earlier post is that in most cases
people will use their keyrings to store keys, and addresses are the
most stable way among human-readable key specifiers to access the
keyring.  Eg, suppose you're replying to me; my display name in this
message won't help you find my key unless your MUA's parser is *very*
"sophisticated" (ie, makes dangerous guesses).

 > (Would it be possible to use the list-id or does it have to be an
 > actual email address?  list-id is considered more stable than
 > posting address.)

List-Id could be used, but do you really think that anybody but larsi
would implement fishing it out of the header and using it as the user
name in a keyring? ;-)[1]  This would also violate PKI user's
expectations about the stability of names, slightly.  Use of display
names to access keyrings is normally interactive because a person can
get that right -- she may remember the display name in the key for
some reason, or use a partial-match accessor.  Programs won't (well,
maybe Prism would, but let's hope Prism doesn't have our keys at
all!), but they will have immediate access to something that *can't*
be misspelled and still be useful (ie, the email address).

 >> Also Barry while running tests I see a few tests are failing
 >> because now simple message will not be able to pass the
 >> 'default-posting-chain' and 'multipart/signed' is requred. So
 >> should I change all the tests?
 > 
 > The test suite is a mess right now.

Translated into pragmatic terms: Don't bother fixing the leaky roof
because Barry's about to bulldoze the house.  VCS implication: your
branch will have hard-to-fix conflicts throughout the test suite.


Footnotes: 
[1]  Lars "larsi" Ingebrittsen is the main developer of the Gnus MUA
for Emacs, known for implementing features first (the IETF thanks
you) and for much-too-clever code.