| 1 |
On 05/12/20 01:24, Michał Górny wrote: |
| 2 |
> W dniu pon, 11.05.2020 o godzinie 20∶20 -0400, użytkownik Aisha Tammy |
| 3 |
> napisał: |
| 4 |
>> Hi devs@, |
| 5 |
>> Seems like for some reason the gentoo.org does not publish the |
| 6 |
>> gpg public keys of the senders, even though it is signed correctly. |
| 7 |
> |
| 8 |
> Why do you claim that? How did you verify it? Why are you jumping |
| 9 |
> straight to passive-aggressive accusations without asking nicely first? |
| 10 |
> |
| 11 |
That last question could very much be asked of you because of your |
| 12 |
asking it of them. They needed information, at least some of which you |
| 13 |
did give, not clutching of pearls and baseless protestations of offense. |
| 14 |
|
| 15 |
>> |
| 16 |
>> Just wanted to know why the devs are required to use gpg keys, glep63 |
| 17 |
>> [1] |
| 18 |
>> but even when the server has the public keys, they aren't published |
| 19 |
>> properly. |
| 20 |
>> |
| 21 |
>> From a proper security perspective, I would have though something |
| 22 |
>> like WKD[2] would have been implemented on the server side for |
| 23 |
>> automated |
| 24 |
>> authentication. |
| 25 |
> |
| 26 |
> WKD is implemented and I don't know a single case where it wouldn't |
| 27 |
> work. If it doesn't work for you, then I dare say it's more likely to |
| 28 |
> be a problem with your setup. However, if it's a problem on our end, |
| 29 |
> I'd really appreciate a bug report before calling us retarded. |
| 30 |
> |
| 31 |
Given that they did not call anyone any names, retarded or otherwise, |
| 32 |
one could make the case that you are making a personal attack against |
| 33 |
them by smearing them and their postings; at best that hurts your |
| 34 |
argument as a supposedly affronted party. So, please, try to not |
| 35 |
construct offense out of whole cloth to be performatively perturbed at; |
| 36 |
it serves no purpose beyond making the lists less useful due to |
| 37 |
increased noise and making social norms in Gentoo (especially on the |
| 38 |
lists) that much less congenial. |
| 39 |
|
| 40 |
> In fact, the link you've posted actually lists gentoo.org as one |
| 41 |
> of the few organizations implementing WKD. |
| 42 |
> |
| 43 |
>> |
| 44 |
>> Maybe I am missing something about how to verify the keys of the |
| 45 |
>> maintainers |
| 46 |
>> who are sending announcements but it irks me a teensy bit when i have |
| 47 |
>> signed |
| 48 |
>> mails and I can't ~~trust~~ verify the signatures. |
| 49 |
>> |
| 50 |
>> |
| 51 |
> |
| 52 |
> You are missing that WKD does not provide authentication, and if it |
| 53 |
> were, it would be considered thoroughly insecure. Authentication |
| 54 |
> in OpenPGP is generally provided via web of trust. For Gentoo |
| 55 |
> developers, you can also use our Authority Keys [3,4,5]. |
| 56 |
> |
| 57 |
>> |
| 58 |
>> [1] |
| 59 |
>> https://wiki.gentoo.org/wiki/Project:Infrastructure/Generating_GLEP_63_based_OpenPGP_keys |
| 60 |
>> [2] https://wiki.gnupg.org/WKD |
| 61 |
> |
| 62 |
> [3] https://www.gentoo.org/downloads/signatures/ |
| 63 |
> [4] https://www.gentoo.org/glep/glep-0079.html |
| 64 |
> [5] https://wiki.gentoo.org/wiki/Project:Infrastructure/Authority_Keys |
| 65 |
> |
| 66 |
> |
Archives