Re: [gentoo-project] Spoofing on list -> Infra response re SPF

[William L. Thomson Jr.]

On Tuesday, December 6, 2016 9:52:02 AM EST Kent Fredric wrote:
> On Mon, 05 Dec 2016 15:22:15 -0500
>
> "William L. Thomson Jr." <wlt-ml@××××××.com> wrote:
> > I was meaning for anyone with @gentoo.org. Like commits must be signed.
> > Its one thing to spoof another list member. No outsider should be able to
> > pose as an @gentoo.org address.
>
> But that means you have to require signing when the from is @gentoo.org ,
> but not otherwise.

Can you think of a reason to not sign an email from @gentoo.org? Would that 
not be the same as not signing a commit?

I really believe this was required in the past. I had serious issues with GPG 
signing with Evolution and Seahorse. Robin/robbat2 got involved as team lead 
to mediate a conflict. One that NEVER made it to comrel since the proper 
resolution mechanisms were in place and worked flawlessly!!!! I even had 
serious culture differences  with dude... 

The only reason I was messing with GPG and emails was it was required. At 
least I was under that impression. Not sure when that changed.

> Which means @gentoo.org can still spoof @example.org :)

That is more of a concern to @example.org than Gentoo. Though something should 
be in place to not allow spoofing all around. IMHO

> I'm not really complaining here, I just don't think it would be consistent,
> only a double standard.

I do hate double standards :)

I would not be against requiring everyone to sign. Though given that MTA's 
allow you to sign emails from others. Not sure it will help. 

I filed a bug with kmail on that.

Verify GPG key emails when signing an email
https://bugs.kde.org/show_bug.cgi?id=373314

And one that allowed me to spoof in the first place...

Make From field in the composer read only
https://bugs.kde.org/show_bug.cgi?id=373313

-- 
William L. Thomson Jr.