Re: [MacPerl] MacPGP.pm 1.0b1 Ready

[pudge@pobox.com (Chris Nandor)]

At 0:17 1/7/97, ??? wrote:
>On Fri, 3 Jan 1997, Chris Nandor wrote:
>
>> Hey, if anyone else is interested in beta testing MacPGP.pm let me know,
>> because it is ready now.  There is still some work left to do, but it is
>> looking good (IMO).  It is my first foray into AppleEvents, and my first
>> major module development, and I think it is going well so far ...
>
>Sorry to jump into this late (I'm whoafully backed up on mailing list
>stuff), but is this all that wise??  I thought Phil Zimmermann warned
>advised against using PGP on multi-user systems.  I thought that it
>only gave a "pretty good" environment if it was run on a machine
>dedicated solely to encryption work, and, isn't anything that is
>AppleEvent scriptable by definition a multi-user machine??
>
>(Sorry to be such a brat ... but I'm trying hard to learn, here.)
>
>Bad security (I thought) was worse than no security, mainly cause it
>always leads to a "false sense of safety".  Did Phil change his views
>on this??  Or am I also (behind) on PGP developments, as well as this
>mail list.

Well, there's three points I can make here:

1.)  My Mac (and I bet most Macs out there) are not multi-user machines,
simply because I am the only one who uses it and I do not allow any program
linking on it.

2.)  Even if I didn't write this module, someone could easily write a
script that could take advantage of MacPGP simply because it DOES accept
AppleEvents.  i.e., I am not giving MacPGP any extra functionality or
greater access, I am just simplifying the access.  Anyone with AppleScript
can do the exact same things that you will be able to do with this module
(although, it will be a much simpler process, of course!).

3.)  It is up to the owner/manager/sysop of each individual machine to
determine whether or not using MacPGP -- or MacPGP.pm -- is appropriate on
each individual machine.  On my machine, it is certainly very appropriate
and does not compromise security one bit.  One some machines, it might be a
huge security risk (though, I reiterate, the risk comes not from MacPGP.pm
but from MacPGP itself, which can be scripted by Frontier, AppleScript, or
any OSA language).

But thank you very much for your input and comments, it made me think a bit
more about it ...

#========================================================================
I guess I kinda lost control, because in the middle of the play I
ran up and lit the evil puppet villain on fire. No, I didn't. Just
kidding. I just said that to help illustrate one of the human emotions,
which is freaking out. Another emotion is greed, as when you kill
someone for money, or something like that. Another emotion is generosity,
as when you pay someone double what he paid for his stupid puppet.

        --Jack Handey

Chris Nandor                                              pudge@pobox.com
PGP Key 0xB76E72AD                                      http://pudge.net/