Secrecy and user trust
David Shaw
dshaw at jabberwocky.com
Tue Sep 9 15:08:51 UTC 2008
On Tue, Sep 09, 2008 at 12:07:36PM +0100, Bill Crawford wrote:
> On 09/09/2008, David Shaw <dshaw at jabberwocky.com> wrote:
>
> > I'm one of the GnuPG developers, and as such, a copy of my key is in
> > /usr/share/doc/gnupg-1.4.x/samplekeys.asc on any system that has
> > gnupg-1.4 installed. It's a key that many (most?) Fedora users
> > already have, and had before this current problem even started. This
> > doesn't mean people should necessarily trust my key, of course, but it
> > does serve as a pretty effective pre-distributed key that can be
> > leveraged for this as its very wide distribution would make it
> > difficult to replace out from under someone without the mischief being
> > very visible (much the same argument that also holds for the new
> > package signing key, of course, except that my key is already widely
> > distributed).
> >
> > As luck has it, I work around half an hour away from the Red Hat
> > Massachusetts office.
>
> Now that, seems like a really good idea :o)
>
> How about you sign, e.g. Jesse's key (if he's willing)?
I'm happy to exchange signatures with Jesse or anyone else in the
Boston area.
To be clear, though: I don't want to give the impression that I think
the release plan is not sufficient. I think it's about as good as it
can be given the facts of how RPM does key management. Any additional
signatures on the package signing key are just a nice bonus for those
who want to do additional checks.
David
More information about the fedora-list
mailing list