[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20130502152442.GD16749@nef.pbox.org>
Date: Thu, 2 May 2013 17:24:42 +0200
From: Alistair Crooks <agc@...src.org>
To: oss-security@...ts.openwall.com
Subject: Re: upstream source code authenticity checking
On Tue, Apr 30, 2013 at 02:24:24PM -0400, Daniel Kahn Gillmor wrote:
> On 04/26/2013 01:57 AM, Alistair Crooks wrote:
> > All people can see from a key listing is who trusted them and
> > when, not how much, or whether the trust was warranted.
>
> Just for the record, most OpenPGP key certification listings don't
> indicate anything at all about trust, including "who trusted them".
> they show cryptographically-verifiable assertions of identity and
> control over key material.
>
> Put another way, a signature on an OpenPGP key+userid says "I believe
> that this key belongs to this person" -- it doesn't say anything about
> trust in that person (or about their intrinsic trustworthiness).
>
> Sorry for the nit-pick, but the term "trust" is so overused and confused
> in these contexts that i think it's important to clarify it when it's
> getting muddled.
Oh, I'm not muddled, I was using the word "trust" as it appears (34
times) in RFC 4880 - mostly relating to 5.2.3.13 "Trust Signature" and
5.10 "Trust Packet".
And if you seriously think someone who searches for my public key on a
webserver, or through mail, or business card, etc, downloads my public
key from one of the servers, imports it into their own pubring, signs
it with their own private key, then mails it to me, or uploads it to
one of the key servers, all without trusting me in any way, then I'll show
you a pretty awful stalker (and fairly inefficient one, due to the
need to sign my pubkey), a fan boy (which is hardly likely to happen
in my case), or someone who is rather sad. (I'm discounting impaired
judgement due to the baroque processes involved here, sorry xkcd).
i.e. no-one goes to that kind of trouble just to say "I know this
person" - that's what facebook and google+ are for.
Regards,
Alistair
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
