Re: Retire keys.fedoraproject.org?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Fri, Jul 5, 2019 at 11:15 AM Pierre-Yves Chibon <pingou@xxxxxxxxxxxx> wrote:
>
> On Tue, Jul 02, 2019 at 02:47:36PM -0700, Kevin Fenzi wrote:
> > Hey everyone,
> >
> > As some of you may have read:
> >
> > https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f
> > and
> > https://dkg.fifthhorseman.net/blog/openpgp-certificate-flooding.html
> >
> > or other media reports about vulnerabilities of the current gpg
> > keyserver software/network/policy.
> >
> > TLDR: Someone can (and has been) flooding sks keyservers with poisoned
> > certs. Users that download from sks keyservers may well find gpg just
> > stops working, hangs, or breaks in terrible ways. The SKS software is no
> > longer maintained and because the policy is 'never delete anything'
> > there's likely no way to mitigate the attacks.
> >
> > I've cc'ed nb here for his take on things, but as I read it, it might be
> > best to just retire the keys.fedoraproject.org service at least for now
> > to avoid breaking users or telling them we have a service they should
> > trust when they really... should not.
>
> Having read this, +1 to decommission this service. This is quite saddening
> though :(
>
> I'd to hear nb's opinion on this but I think we may want to announce our intent
> and turn it off somewhat soon.
>

As someone who relies on keys.fedoraproject.org quite a lot, I'm sad
that we have to decommission it...

If we ever brought it back, we'd probably want to configure the server
to not be part of the SKS server ring...




--
真実はいつも一つ!/ Always, there's only one truth!
_______________________________________________
infrastructure mailing list -- infrastructure@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to infrastructure-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/infrastructure@xxxxxxxxxxxxxxxxxxxxxxx




[Index of Archives]     [Fedora Development]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [KDE Users]

  Powered by Linux