Re: Travis CI MITM RCE

[Daniel Kahn Gillmor <dkg () fifthhorseman net>]

On Sat 2018-08-25 20:56:59 -0400, Phil Pennock wrote:
> The keyservers are a swamp; if you want to include one key, then include
> the key as static data in your builds/CI configuration, so that it's
> coming from a trusted source each time: your own data.

This is great advice, and not just for builds/CI configuration.

I made a similar suggestion recently to clean up the starttls-everywhere
datafile updater:

    https://github.com/EFForg/starttls-everywhere/pull/65/commits/eb0a28e3fa141d4fb445c00df3ab7f3765ded859

In some ways, the keyserver network has done the OpenPGP community a
disservice, by encouraging OpenPGP users to refer to keys by
fingerprints (or even worse, by key IDs).  While this is a useful
shorthand in some contexts, it's really a security/reliability
anti-pattern when it comes to secure programming.

      --dkg

Attachment: signature.asc
Description: