Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 28 Aug 2018 12:43:16 -0400
From: Daniel Kahn Gillmor <dkg@...thhorseman.net>
To: Phil Pennock <oss-security-phil@...dhuis.org>, oss-security@...ts.openwall.com
Cc: Jakub Wilk <jwilk@...lk.net>
Subject: Re: Travis CI MITM RCE

On Sat 2018-08-25 20:56:59 -0400, Phil Pennock wrote:
> The keyservers are a swamp; if you want to include one key, then include
> the key as static data in your builds/CI configuration, so that it's
> coming from a trusted source each time: your own data.

This is great advice, and not just for builds/CI configuration.

I made a similar suggestion recently to clean up the starttls-everywhere
datafile updater:

    https://github.com/EFForg/starttls-everywhere/pull/65/commits/eb0a28e3fa141d4fb445c00df3ab7f3765ded859

In some ways, the keyserver network has done the OpenPGP community a
disservice, by encouraging OpenPGP users to refer to keys by
fingerprints (or even worse, by key IDs).  While this is a useful
shorthand in some contexts, it's really a security/reliability
anti-pattern when it comes to secure programming.

      --dkg

Download attachment "signature.asc" of type "application/pgp-signature" (228 bytes)

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.