Date: Mon, 04 Apr 2011 23:00:42 +0200 From: Yves-Alexis Perez <corsac@...ian.org> To: oss-security@...ts.openwall.com Subject: Re: Web of trust On lun., 2011-04-04 at 16:41 +0200, Nico Golde wrote: > Ok please use nion@...ian.org with E1AB DE0E FFCA AEF3 9494 7592 CD4B 2AF3 A0A0 AAAA. > This key is signed by 73647CFF which is in the Debian keyring and a transition > statement signed by 73647CFF as well is online at http://nion.modprobe.de/key-transition-2008-06-01.txt.asc Sorry for diverting the thread. I'm not intending to request subscription to vendor-sec (I'm not yet really active in Debian security team) but considering the use of GPG, would it make sense to have at least some kind of “web of trust” thing on the involved keys? That plus subscribing the project address when possible could help maintaining some confidence about where the mail really ends (though that doesn't mean it can't be leaked later). I'm not sure the procedure Debian use for cross-signing would fit because it involves physical meeting (and usually beer signing too) and it might not be practical, but it's still an idea. Regards, -- Yves-Alexis Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.