[117021] in Cypherpunks
Re: Black Bag Jobs VS Shopping Bag Jobs
daemon@ATHENA.MIT.EDU (steve bryan)
Wed Aug 25 11:07:54 1999
Mime-Version: 1.0
Message-Id: <v04210100b3e9a8d340d9@[204.1.1.99]>
In-Reply-To: <199908242310.TAA28502@cti06.citenet.net>
Date: Wed, 25 Aug 1999 09:48:52 -0500
To: "Jean-Francois Avon" <jf_avon@citenet.net>
From: steve bryan <sbryan@vendorsystems.com>
Cc: cypherpunks@cyberpass.net
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
Reply-To: steve bryan <sbryan@vendorsystems.com>
>As a side question:
>Did anybody check if the actual PGP binaries distribution is identical to what
>you obtain upon compilation of the published source?
Yes, I did for PGP 6.0 on the Macintosh. It did correspond for the
binaries I chose to look at. There were two differences which were
entirely logical. For PowerPC executables a compilation date is
recorded and that differed between what I compiled and what could be
downloaded. Also there is a dead-space in the resource map of the
resource fork of any file that contains arbitrary bytes. For the sake
of consistency it might make sense for PGP to zero out these bytes
after building the binary. I don't blame them for not choosing to do
so. The rest was identical, byte for byte. I'm looking forward to
doing the same sort of check for PGP 6.5.1 when the source gets
posted on pgpi.com.
Note that this was a casual examination for the sake of curiosity. I
hope that some organizations and/or individuals are subjecting it to
systematic analysis. Also, does anyone know where to find the
published book of source code that is used to generate the code that
appears on the pgpi.com web site? I bet if O'Reilly were to publish
the PGP source rather than whoever does now they might even be able
to sell enough to make it worth their while. It is also, along with
linux, arguably the most important example of open source which
O'Reilly sees as its mission.
