[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 19 Aug 2013 22:27:13 -0600
From: Kevin Fenzi <kevin@...ye.com>
To: kseifried@...hat.com
Cc: oss-security@...ts.openwall.com, "Eric H. Christensen"
<echriste@...hat.com>, security@...tgresql.org
Subject: Re: PostgreSQL insecure install via yum (multiple
problems)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
On Mon, 19 Aug 2013 22:11:13 -0600
Kurt Seifried <kseifried@...hat.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 08/19/2013 07:19 PM, Eric H. Christensen wrote:
> > On Mon, Aug 19, 2013 at 06:58:22PM -0600, Kurt Seifried wrote:
> >> Signing RPM's isn't very useful if you never make the signing
> >> key available!
> >
> > You mean like this:
> > http://keys.fedoraproject.org/pks/lookup?search=0x442df0f8&op=vindex
> >
> > I'm pretty sure pgp.mit.edu isn't the best source for PGP keys any
> > longer, unfortunately.
>
> Dunno who to ask, so adding Scrye: can we make sure Google indexes the
> Fedora key server?
I'm happy to answer, but am not on some of the list's CC'ed, so feel
free to pass my reply on. ;)
keys.fedoraproject.org is just recently revived. We had some issues
with the sks software that runs on it and it was down for quite some
time. Those issues are hopefully solved now so we can bring it up full
time.
Hopefully google will notice it once it's been up for a while.
> This actually raises a good point, what are the key
> servers now? The big 3 used to be:
>
> http://pgp.mit.edu/
> http://keyserver.pgp.com/
> http://sks-keyservers.net/
keys.fedoraproject.org should sync with sks-keyservers.net.
Not sure about the other 2.
kevin
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.20 (GNU/Linux)
iQIcBAEBCgAGBQJSEvAkAAoJEEs3sNgP+7teOI4QAJa9pLrruBTevGKTL64nnHoP
P+wVKOIeKLc00OCiF0zmLgCvgjG2i6FgcWgvbdzOvS3fBTF3P29fqZ1CtwQEWUko
cU0i/sDOYspImg0F3kM65BzLZpTOW6jJFU29LFcNYDkFOailCfoszL9FX25wPDe4
0pB6I3o7fAe4knQ4hUzyNrbWrwtUpE1IJVJedipC5pJu3OGt2lkT7jP48WiugWyz
0lCQ/MZtcwOVmAztkK4PYH2iJfYI36EyviKRYHjbsywrrgAFshIKzYLROVkQco8C
EVWt89L16wU/zFLYt00J6FJUGU+6xAkAYKg5GaUfcwI/swpd76FP71COfsz3c5l+
HyXwtDRADNb3cCnFzCuBqNnaaDrT7hTxin69/XaFjKIuNSMm8YsnkbCYcNzHzKGh
jBJ5gST6yJYaIlLIB2rlADdQ1jIeJG1plLMhmwjayi+m5lQh54mgWiok2jIKvENu
/o0gJemhjzc4E3o8yMKzqiMsH9jwKeS70FRO1zpo87VTD/P+8v3SPTw9H/GpyrN0
U1dc4S/XDoJEuUIHCoZCBRvWnnnl9Eue7wYjlCsj1Un0wtJz2hXbTfZONvSfO52A
fHC5U5WZyDwl4NjBg/M0A1bHMwA90UztnYaQXJai326jsTLjf+5v1mT+9iRRFwKU
AeZZpZZPugIEychcXVL0
=mXzc
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
