Secrecy and user trust
Bill Crawford
billcrawford1970 at gmail.com
Tue Sep 9 11:07:36 UTC 2008
On 09/09/2008, David Shaw <dshaw at jabberwocky.com> wrote:
> I'm one of the GnuPG developers, and as such, a copy of my key is in
> /usr/share/doc/gnupg-1.4.x/samplekeys.asc on any system that has
> gnupg-1.4 installed. It's a key that many (most?) Fedora users
> already have, and had before this current problem even started. This
> doesn't mean people should necessarily trust my key, of course, but it
> does serve as a pretty effective pre-distributed key that can be
> leveraged for this as its very wide distribution would make it
> difficult to replace out from under someone without the mischief being
> very visible (much the same argument that also holds for the new
> package signing key, of course, except that my key is already widely
> distributed).
>
> As luck has it, I work around half an hour away from the Red Hat
> Massachusetts office.
Now that, seems like a really good idea :o)
How about you sign, e.g. Jesse's key (if he's willing)?
> David
Bill
More information about the fedora-list
mailing list