Re: [gentoo-dev] Finger GLEP

[Tavis Ormandy <taviso@gentoo.org>]

On Mon, Aug 11, 2003 at 10:24:40AM +0200, Paul de Vrieze wrote:
> 
> There are advantages and disadvantages. For pgp keys I personally believe
> that this is not the way to go. In case a dev box gets rooted it is very
> easy for a hacker to update a .gpgkey file, but if we would have an
> authenticated and automated process changing the key in the ldap database
> (through an easy to use script) that would increase security a lot while
> still getting all the data at one place.

Thats no more secure than the finger solution, once a developer's box is
rooted, all bets are off. At this point the hacker can already trojan
gpg/ssh/whatever and harvest all the passphrases and key pairs he wants, 
rendering the gpg key useless.

> As such I believe that if we want to provide a finger service it
> will need to be ldap aware and pull most information from ldap, and/or
> other sources. For example for projects the current plan is to create
> project.xml files containing information about the project. Including who
> is part of the project.

maybe, but im a fan of the simplicity of finger. The name and location
is the standard information from the passwd file, and three plain text
files the dev can configure as they see fit. 

-- 
-------------------------------------
taviso@sdf.lonestar.org | finger me for my gpg key.
-------------------------------------------------------

--
gentoo-dev@gentoo.org mailing list