Date: Tue, 28 Aug 2018 12:43:16 -0400 From: Daniel Kahn Gillmor <dkg@...thhorseman.net> To: Phil Pennock <oss-security-phil@...dhuis.org>, oss-security@...ts.openwall.com Cc: Jakub Wilk <jwilk@...lk.net> Subject: Re: Travis CI MITM RCE On Sat 2018-08-25 20:56:59 -0400, Phil Pennock wrote: > The keyservers are a swamp; if you want to include one key, then include > the key as static data in your builds/CI configuration, so that it's > coming from a trusted source each time: your own data. This is great advice, and not just for builds/CI configuration. I made a similar suggestion recently to clean up the starttls-everywhere datafile updater: https://github.com/EFForg/starttls-everywhere/pull/65/commits/eb0a28e3fa141d4fb445c00df3ab7f3765ded859 In some ways, the keyserver network has done the OpenPGP community a disservice, by encouraging OpenPGP users to refer to keys by fingerprints (or even worse, by key IDs). While this is a useful shorthand in some contexts, it's really a security/reliability anti-pattern when it comes to secure programming. --dkg Download attachment "signature.asc" of type "application/pgp-signature" (228 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.