From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gentoo-dev-return-5464-arch-gentoo-dev=gentoo.org@gentoo.org>
Received: (qmail 17516 invoked by uid 1002); 11 Aug 2003 13:00:01 -0000
Mailing-List: contact gentoo-dev-help@gentoo.org; run by ezmlm
Precedence: bulk
List-Post: <mailto:gentoo-dev@gentoo.org>
List-Help: <mailto:gentoo-dev-help@gentoo.org>
List-Unsubscribe: <mailto:gentoo-dev-unsubscribe@gentoo.org>
List-Subscribe: <mailto:gentoo-dev-subscribe@gentoo.org>
List-Id: Gentoo Linux mail <gentoo-dev.gentoo.org>
X-BeenThere: gentoo-dev@gentoo.org
Received: (qmail 4816 invoked from network); 11 Aug 2003 12:59:58 -0000
Date: Mon, 11 Aug 2003 12:59:53 +0000
From: Tavis Ormandy <taviso@gentoo.org>
To: Paul de Vrieze <pauldv@gentoo.org>
Cc: gentoo-dev@gentoo.org
Message-ID: <20030811125953.GA21839@sdf.lonestar.org>
References: <20030810223914.GB27538@sdf.lonestar.org> <20030810232734.GJ1819@mail.lieber.org> <20030811000210.GB8548@sdf.lonestar.org> <20030811092156.GO1819@mail.lieber.org> <20030811113518.GA29154@sdf.lonestar.org> <16892.134.188.150.80.1060605459.squirrel@callisto.cs.kun.nl>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <16892.134.188.150.80.1060605459.squirrel@callisto.cs.kun.nl>
User-Agent: Mutt/1.5.3i
Subject: Re: [gentoo-dev] Finger GLEP
X-Archives-Salt: e210b726-0ff2-45e4-8d4c-d445d779c1ce
X-Archives-Hash: c29c740f1082b5c443ffa0f2e4caeeb1

On Mon, Aug 11, 2003 at 02:37:39PM +0200, Paul de Vrieze wrote:
> 
> Tavis Ormandy said:
> >
> > well, more like
> >
> > 	$ wget -O - -q http://keys.gentoo.org/devname.gpg | gpg --import
> >
> 
> No, more like gpg --search-keys devname@gentoo.org or
> gpg --recv-keys <fingerprint>
> 
> Paul
> 

even more like, 

$ mozilla http://keys.gentoo.org/
<navigate to developers key page, copy and paste fingerprint>
$ gpg --search-keys devname@gentoo.org
<confirm fingerprint on key server matches key you received>

Anybody can publish a key to a keyserver, if your going to use that
method you still need to distribute fingerprints and key id's.

Yes, in a perfect world everybody would double check everything, but
thats not going to happen.

by using a finger server, users can be reasonably confident they are
getting the correct key.

I can see im not convincing you of this idea :) Thanks for your feedback 
though, very interesting.

-- 
-------------------------------------
taviso@sdf.lonestar.org | finger me for my gpg key.
-------------------------------------------------------

--
gentoo-dev@gentoo.org mailing list