[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <87sh2y5tnf.fsf@fifthhorseman.net>
Date: Tue, 28 Aug 2018 12:43:16 -0400
From: Daniel Kahn Gillmor <dkg@...thhorseman.net>
To: Phil Pennock <oss-security-phil@...dhuis.org>, oss-security@...ts.openwall.com
Cc: Jakub Wilk <jwilk@...lk.net>
Subject: Re: Travis CI MITM RCE
On Sat 2018-08-25 20:56:59 -0400, Phil Pennock wrote:
> The keyservers are a swamp; if you want to include one key, then include
> the key as static data in your builds/CI configuration, so that it's
> coming from a trusted source each time: your own data.
This is great advice, and not just for builds/CI configuration.
I made a similar suggestion recently to clean up the starttls-everywhere
datafile updater:
https://github.com/EFForg/starttls-everywhere/pull/65/commits/eb0a28e3fa141d4fb445c00df3ab7f3765ded859
In some ways, the keyserver network has done the OpenPGP community a
disservice, by encouraging OpenPGP users to refer to keys by
fingerprints (or even worse, by key IDs). While this is a useful
shorthand in some contexts, it's really a security/reliability
anti-pattern when it comes to secure programming.
--dkg
Download attachment "signature.asc" of type "application/pgp-signature" (228 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
