(Begin Message)
It’s true that the main topic of this thread is regarding where to store book reviews - but a bulk of this thread’s comments and actual discussion have been about signed contributions. How can we trust that a contribution has not been edited since it was signed? How do we know this particular signed contribution was not created by an impostor? Is there development work that could be done at a given website that could somehow improve the “signed contribution” functionality, perhaps by improving its trustworthiness?
Well, I am very surprised that no one has brought up the topic of “digital signatures” (
http://en.wikipedia.org/wiki/Digital_signature). I’ll say a few words in this regard, just so that anyone who feels strongly about the issue of signatures or signed content knows this is one workable solution. They can do their own research into the topic if they so desire.
A hopefully brief crash course: What is a digital signature? Digital signatures has it’s roots in cryptography and encryption, so lets begin there. Everyone has at least some vague concept of how encryption works. There’s some data that’s been scrambled and we can’t read it without “the key”. In one particular model, there are actually two keys. One key is my “private key”, that I don’t share with anyone. Another key is my “public key” - that I share at least one other person. Any message encrypted with my private key can be decrypted by someone with my public key. The most obvious application of encryption is keeping secrets. Only someone with my public key can read the message. But, there are some neat side effects that fall out of the math. For example, if my public key decrypts a message, you can be sure that only my private key could have encrypted it. In other words, if you can trust that I haven’t shared my private key with anyone else, you can be sure the message came from me - and me alone. Also, you can be sure that if my public key decrypts the message, the message has not been altered since I encrypted it.
So, what’s a digital signature? It’s a method of using encryption to achieve those last two side effects (guaranteed authorship, guaranteed message integrity) without any messy scrambling of the message itself. The message itself remains readable to anyone and everyone. But anyone with my public key can also go one step further and verify that the message was digitally signed using my private key. Now if I choose to share my public key with everyone (say, for example, by posting it on my personal website), now anyone with a little bit of free time can verify my digital signature to ensure a message, or book review, or any data both came from me, and has not been altered.
The fun part is, digital signatures can work anywhere that I am allowed to write a message. We don’t have to do extra work to support them.
I’ll be signing this message, and providing a public key just as a small demonstration.
The commands I used to generate this can be found on the following website:
http://www.madboa.com/geek/openssl/#key-rsa(End Message)
-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDhIJl1olKMD8q9mKhe3UJDgARR
mkP8YJs4R8HKVMvC2VJ49SjdDs4t/qyp0FUHmqfebxWspgh31ufblO8OaB2c0s6a
4h2i4/g/DYFLwubUSX9ahYHnQdQcmI5Wru/TBvEcLcW7TgOdgHddZVDtdN8wkX7f
1x9FMKpPz5Loedg3uwIDAQAB
-----END PUBLIC KEY-----
--- BEGIN SHA1 digital signature (as hexdump)---
1b 31 da 80 ca 22 03 40 94 8a 65 1e ba 1d aa 30
df 56 77 72 8c 32 67 a3 47 53 27 62 54 7a 8b 97
5f cd f8 88 a6 ae 0b 24 9c b8 d5 99 b1 ea 0f 59
85 6a 66 6e ac f2 a0 59 2c 0e c8 33 c8 c2 17 e5
76 e0 bc e0 cc 98 ab 3f 5c f6 5e 8b 99 dc ba 3e
41 6d 9a 0e bd 6f f5 ff f3 f0 57 d2 68 cb e3 04
1b 5b e5 b9 06 6c 03 1c e3 4e a1 8c 70 be b3 0c
c1 d4 54 a9 42 96 74 86 b4 42 de e3 ae 84 04 9c
--- END SHA1 digital signature ---
A couple last things, lets assume ascii encoding for this post. Also the public key given here is not necessarily my authoritative public key, just one I generated for use in this post. Finally, I am not an expert on this subject, but hopefully this rough outline of the topic is still accurate enough to be of some use or interest.