[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <87bjjfh5tw.fsf@gmail.com>
Date: Tue, 30 Dec 2025 16:07:23 -0800
From: Collin Funk <collin.funk1@...il.com>
To: Henrik Ahlgren <pablo@...stieto.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: Many vulnerabilities in GnuPG
Henrik Ahlgren <pablo@...stieto.com> writes:
> Peter Gutmann <pgut001@...auckland.ac.nz> writes:
>
>> Does anything actually use the cobweb of trust, or do you just assume the key
>> you've got is good because doing anything else is too hard?
>
> Perhaps the Debian developer keyring would serve as a compelling
> example? They even organize actual key-signing parties, which many
> cryptography experts today appear to regard as "LARPing" or otherwise
> ridiculous.
Or the Linux kernel [1].
Collin
[1] https://www.kernel.org/doc/html/v6.19-rc2/process/maintainer-pgp-guide.html#using-the-kernel-org-web-of-trust-repository
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
