Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 28 Aug 2018 12:43:16 -0400
From: Daniel Kahn Gillmor <>
To: Phil Pennock <>,
Cc: Jakub Wilk <>
Subject: Re: Travis CI MITM RCE

On Sat 2018-08-25 20:56:59 -0400, Phil Pennock wrote:
> The keyservers are a swamp; if you want to include one key, then include
> the key as static data in your builds/CI configuration, so that it's
> coming from a trusted source each time: your own data.

This is great advice, and not just for builds/CI configuration.

I made a similar suggestion recently to clean up the starttls-everywhere
datafile updater:

In some ways, the keyserver network has done the OpenPGP community a
disservice, by encouraging OpenPGP users to refer to keys by
fingerprints (or even worse, by key IDs).  While this is a useful
shorthand in some contexts, it's really a security/reliability
anti-pattern when it comes to secure programming.


Download attachment "signature.asc" of type "application/pgp-signature" (228 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.