[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Common merge request format (was: [Gnu-arch-users] Preferences for b

From: Robin Green
Subject: Re: Common merge request format (was: [Gnu-arch-users] Preferences for branching in merge submissions?)
Date: Fri, 9 Apr 2004 19:27:44 +0100
User-agent: Mutt/1.5.4i

On Fri, Apr 09, 2004 at 05:42:12AM +0100, Andrew Suffield wrote:
> On Thu, Apr 08, 2004 at 06:33:38PM +0100, Robin Green wrote:
> > From-Gpg-Key:  
> Why?

Because checking with a completely untrusted key is slightly more
secure than no signature check at all. At least you can tell that (assuming
that no-one else has the private key) the person who committed today
was the same person that committed yesterday.

If the submitter posts to a mailing list and signs all their posts, and you
automatically download public keys for all signed posts, that provides a
further measure of confidence against impersonations. (This is assuming
that the script complains loudly and aborts if it finds a live key
that differs from an existing live key that you have for the same email

What would you suggest instead?

> As a PKI effort, it's spectacularly ineffective...

What do you mean by "a PKI effort"? It's not intended to be fully trustworthy
- that's what key signing is for.

Attachment: pgpDZk7FzdBEu.pgp
Description: PGP signature

reply via email to

[Prev in Thread] Current Thread [Next in Thread]