[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 4 Apr 2011 22:21:34 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: my key
On Mon, Apr 04, 2011 at 04:26:35PM +0200, Sebastian Krahmer wrote:
> "we have nothing to hide", thats why we use GPG keys and force
> the whole Open Source security community to run naked on
> the grass with a unique (key-) ID on the back.
> Someone got "transparency" wrong.
Perhaps, but how do we get transparency right? There's no single
correct opinion on that. The "discussion" we're having is similar to
what we could have in private otherwise, and quite possibly it would
eventually leak anyway. In fact, there's all this talk on making the
private list's archive public with a delay - which means that info on
new members joining, etc. would be public with a delay as well. Then
why the delay (for this info)?
That said, I agree that having specific e-mail addresses and key IDs
posted to a public list is excessive. If anyone else wishes to join
(and qualifies), please state so in the "Closed list" thread and justify
your request (currently that would mean info on the Linux distro you're
a security contact for), then e-mail the specific e-mail address and PGP
key info to me off-list. I'll continue to reply on the list, but the
specific e-mail addresses and keys will be exposed a little bit less.
... now I expect to hear some objections to that change. Anyone? ;-)
> Nevertheless, I generated a fresh key for that purpose,
> signed with our security@...e.de key (3D25D3D9).
Added.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
