Hi Daniel, On Thu, 2017-02-16 at 13:54 -0500, Daniel Kahn Gillmor wrote: > Package: ui-auto > Version: 1.2.9
(...) > the debrsign workflow isn't a particularly safe one (see discussion > on > https://bugs.debian.org/855282 and https://bugs.debian.org/855320). > > ui-auto should not encourage its use, and should probably either > explicitly deprecate or just drop support for the debrsign option. > > Additionally, ui-auto-rsign seems to encourage the same dubious > workflow of making ssh connections from untrusted machines to trusted > machines. It should probably be deprecated or removed as well. thx for the note :). ui-auto is not actively developed any more, it's basically 'compat- maintained' for projects still using it -- i.e., I do not much like dropping functionality. Would it be sufficient to add appropriate warnings - in the example user.conf (*_rsign and *_debrsign options) - when *_rsign resp. *_debrsign are called (as warning log) - when ui-auto-rsign is called (as warning log) ? Fwiw, both options (rsign or debrsign) are disabled by default and need explicit configuration by the user. Thx! Stephan
