Re: Your Thoughts

2019-07-03 Thread Leo Gaspard via Gnupg-users
Alyssa Ross writes: >> > For example, why isn't ask-cert-level a default? >> >> For an alternative view on ask-cert-level see also: >> >> https://debian-administration.org/users/dkg/weblog/98 > > Oh, interesting. Thank you for showing this to me. I had it in my head > that a "weak" signature would

Re: SKS Keyserver Network Under Attack

2019-07-01 Thread Leo Gaspard via Gnupg-users
Mirimir via Gnupg-users writes: >>- Embeds a hardcoded list of already-disrupted keys for which packets >> should be filtered-out when serving them > > That's what I meant. Plus some mechanism for testing keys, so poisoned > ones are blocked, as soon as possible. > > It'd also be useful f

Re: SKS Keyserver Network Under Attack

2019-06-30 Thread Leo Gaspard via Gnupg-users
> 1. We would have to ensure that all keyservers block the same > uploads. One permissive keyserver is a backdoor into the entire > system. We can’t block bad keys at reconciliation time for the same > reasons that have been hashed to death already. One way to do that, though it would mean officia

Re: [NIIBE Yutaka] STM32F103 flash ROM read-out service

2018-06-06 Thread Leo Gaspard via Gnupg-users
On 06/06/2018 06:56 PM, NdK wrote: > Il 06/06/2018 17:49, Tom Li via Gnuk-users ha scritto: > >> BTW, BasicCard and JavaCard seemed even more obscure and I cannot find >> any public service of cracking. > Because those are (at least should be) based on secure chips. > >> But it does not solve any

Re: Breaking changes

2018-05-22 Thread Leo Gaspard via Gnupg-users
On 05/23/2018 01:40 AM, Dennis Clarke wrote:>> The longer you leave people with maintenance, the longer they will want >> maintenance past the deadline. >> > > [1] Then a service org should exist that charges fees. This service org already exists, is named in the message you replied to, and is ca

Re: Breaking changes

2018-05-22 Thread Leo Gaspard via Gnupg-users
On 05/22/2018 11:48 PM, Dennis Clarke wrote: > On 05/22/2018 05:38 PM, Dan Kegel wrote: >> Lessee... >> https://en.wikipedia.org/wiki/GNU_Privacy_Guard >> already give an end-of-life date for 2.0, but none for 1.4. >> And since Ubuntu 16.04 includes 1.4, there are likely >> to still be a few vocal

Re: Efail or OpenPGP is safer than S/MIME

2018-05-14 Thread Leo Gaspard via Gnupg-users
On 05/14/2018 09:45 AM, Werner Koch wrote:> The topic of that paper is that HTML is used as a back channel to create > an oracle for modified encrypted mails. It is long known that HTML > mails and in particular external links like > are evil if the MUA actually honors them (which many meanwhile