Re: Making releases

["Dr. Pete Jemian" <jemian@unicat-sun.mrl.uiuc.edu>]

Seems like somebody missed a point here about CD-R (CD-Recordable)
technology and how it works.

> From: biocca@csg.lbl.gov (Alan K Biocca)
> 
> > From I.Smith@roe.ac.uk  Tue Feb 14 01:15:15 1995
> > 
> > At the consortium meeting I suggested distribution via CDs.  This was 
> > considered too expensive.  In the light of the new concerns about 
> > security,  is this cost now overshadowed by the secure method of 
> > distribution that it offers?
> 
> Perhaps more important than cost is timeliness - the distribution needs to 
> be tweaked too often to produce cdroms.  Who would want to wait for the
> 'final' tweak, and then wait another N weeks for production and transportation..

For the "final" version, the time frame would be weeks.  
For pre-release versions, though, a single CD can be written from 
the desktop using a CD-R device.  Current price of CD-R devices 
is $2500 +/- $500.

> We normally get started with an early version and then incorporate the final
> later.  This would make for many cdrom versions.  Cdrom is excellent for
> infrequent releases of stable products to large audiences.  Our audience is
> small - production costs are high until a thousand or more
> are molded in a run...

This approach is for a production run of CDs from a master.
Seems like EPICS is a pretty good application for CD-R since it is 
written directly onto the CD without an intermediate mold and
the final number of pieces is small.

> I think we should combine suggestions and provide a three-pronged approach:
> 
> 1) Use an ftp site with an account/password (this minimizes the number of
>    copies of the encrypted tarfiles floating about) AND
> 
> 2) Encrypt with PGP -c (normal private key encryption), handling keys
>    by off-net channels to a minimum set of individuals who have signed
>    non-disclosure agreements on the keys and source.
> 
>    Remember that the need to keep the key secure is exactly the same as
>    keeping the source distribution secure.  If it is relatively difficult
>    to get the encrypted distribution the key alone is not useful.
>     
> 3) For those sites who don't or can't handle the encryption, put an
>    exebyte in the mail, or setup a special account and password and
>    then break it down as soon as they have downloaded.  This is still
>    weak since snooping the download is not difficult.
>   
>     
> Alan K Biocca
> 

4)  Alternative to exabyte tape is a CD.  
    Usual advantages/disadvantages apply. 

Pete Jemian