Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 04 Apr 2011 23:00:42 +0200
From: Yves-Alexis Perez <>
Subject: Re: Web of trust

On lun., 2011-04-04 at 16:41 +0200, Nico Golde wrote:
> Ok please use with E1AB DE0E FFCA AEF3 9494 7592 CD4B 2AF3 A0A0 AAAA.
> This key is signed by 73647CFF which is in the Debian keyring and a transition 
> statement signed by 73647CFF as well is online at 

Sorry for diverting the thread. I'm not intending to request
subscription to vendor-sec (I'm not yet really active in Debian security
team) but considering the use of GPG, would it make sense to have at
least some kind of “web of trust” thing on the involved keys? That plus
subscribing the project address when possible could help maintaining
some confidence about where the mail really ends (though that doesn't
mean it can't be leaked later).

I'm not sure the procedure Debian use for cross-signing would fit
because it involves physical meeting (and usually beer signing too) and
it might not be practical, but it's still an idea.


Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.