Re: [gentoo-dev] Finger GLEP

[Tavis Ormandy <taviso@gentoo.org>]

On Mon, Aug 11, 2003 at 02:37:39PM +0200, Paul de Vrieze wrote:
> 
> Tavis Ormandy said:
> >
> > well, more like
> >
> > 	$ wget -O - -q http://keys.gentoo.org/devname.gpg | gpg --import
> >
> 
> No, more like gpg --search-keys devname@gentoo.org or
> gpg --recv-keys <fingerprint>
> 
> Paul
> 

even more like, 

$ mozilla http://keys.gentoo.org/
<navigate to developers key page, copy and paste fingerprint>
$ gpg --search-keys devname@gentoo.org
<confirm fingerprint on key server matches key you received>

Anybody can publish a key to a keyserver, if your going to use that
method you still need to distribute fingerprints and key id's.

Yes, in a perfect world everybody would double check everything, but
thats not going to happen.

by using a finger server, users can be reasonably confident they are
getting the correct key.

I can see im not convincing you of this idea :) Thanks for your feedback 
though, very interesting.

-- 
-------------------------------------
taviso@sdf.lonestar.org | finger me for my gpg key.
-------------------------------------------------------

--
gentoo-dev@gentoo.org mailing list