Date: Mon, 4 Apr 2011 22:21:34 +0400 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Subject: Re: my key On Mon, Apr 04, 2011 at 04:26:35PM +0200, Sebastian Krahmer wrote: > "we have nothing to hide", thats why we use GPG keys and force > the whole Open Source security community to run naked on > the grass with a unique (key-) ID on the back. > Someone got "transparency" wrong. Perhaps, but how do we get transparency right? There's no single correct opinion on that. The "discussion" we're having is similar to what we could have in private otherwise, and quite possibly it would eventually leak anyway. In fact, there's all this talk on making the private list's archive public with a delay - which means that info on new members joining, etc. would be public with a delay as well. Then why the delay (for this info)? That said, I agree that having specific e-mail addresses and key IDs posted to a public list is excessive. If anyone else wishes to join (and qualifies), please state so in the "Closed list" thread and justify your request (currently that would mean info on the Linux distro you're a security contact for), then e-mail the specific e-mail address and PGP key info to me off-list. I'll continue to reply on the list, but the specific e-mail addresses and keys will be exposed a little bit less. ... now I expect to hear some objections to that change. Anyone? ;-) > Nevertheless, I generated a fresh key for that purpose, > signed with our security@...e.de key (3D25D3D9). Added. Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.