oss-sec mailing list archives
Re: Travis CI MITM RCE
From: Daniel Kahn Gillmor <dkg () fifthhorseman net>
Date: Tue, 28 Aug 2018 12:43:16 -0400
On Sat 2018-08-25 20:56:59 -0400, Phil Pennock wrote:
The keyservers are a swamp; if you want to include one key, then include the key as static data in your builds/CI configuration, so that it's coming from a trusted source each time: your own data.
This is great advice, and not just for builds/CI configuration. I made a similar suggestion recently to clean up the starttls-everywhere datafile updater: https://github.com/EFForg/starttls-everywhere/pull/65/commits/eb0a28e3fa141d4fb445c00df3ab7f3765ded859 In some ways, the keyserver network has done the OpenPGP community a disservice, by encouraging OpenPGP users to refer to keys by fingerprints (or even worse, by key IDs). While this is a useful shorthand in some contexts, it's really a security/reliability anti-pattern when it comes to secure programming. --dkg
Attachment:
signature.asc
Description:
Current thread:
- Travis CI MITM RCE Jakub Wilk (Aug 25)
- Re: Travis CI MITM RCE Phil Pennock (Aug 26)
- Re: Travis CI MITM RCE Jeremy Stanley (Aug 26)
- Re: Travis CI MITM RCE Daniel Kahn Gillmor (Aug 28)
- Re: Travis CI MITM RCE zugtprgfwprz (Aug 30)
- Re: Travis CI MITM RCE vines (Aug 31)
- Re: Travis CI MITM RCE zugtprgfwprz (Sep 01)
- Re: Travis CI MITM RCE Daniel Kahn Gillmor (Aug 31)
- Re: Travis CI MITM RCE zugtprgfwprz (Sep 01)
- Re: Travis CI MITM RCE Phil Pennock (Aug 26)