linux-kernel - Re: [GIT PULL] final round of SCSI updates for the 6.7+ merge window

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 21 Jan 2024 01:30:38 -0500
From: "Theodore Ts'o" <tytso@....edu>
To: Linus Torvalds <torvalds@...ux-foundation.org>, G@....edu
Cc: James Bottomley <James.Bottomley@...senpartnership.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        linux-scsi <linux-scsi@...r.kernel.org>,
        linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: [GIT PULL] final round of SCSI updates for the 6.7+ merge window

On Sat, Jan 20, 2024 at 11:35:18AM -0800, Linus Torvalds wrote:
> Guess why I don't? BECAUSE NOBODY ELSE DOES THAT POINTLESS EXPIRY DANCE.

So I guess I need to confess.  I haven't been doing the expiry dance
(which I started doing because GPG revocation certificates are also a
disaster).  There are certainly those folks who recommend it as a best
practice[1].

[1] https://www.g-loaded.eu/2010/11/01/change-expiration-date-gpg-key/

However, I tend to set the expiration 6 to 12 months in
advance, and make sure I renew them 3 months or so before they expire,
and then I make a point of sending them to keys@...ux.kernel.org to
update the the kernel keyring, as documented here[2].

[2] https://korg.docs.kernel.org/pgpkeys.html

Linus, you haven't been complaining about my key, which hopefully
means that I'm not causing you headaches (or at least I hope so).
Would it be perhaps because you are periodically running
scripts/korg-refresh-keys as documented in [2].  Or perhaps you are
running it out of cron or a systemd timer (again, as documented in [2])?

Unlike James, I've tried to use DANE, since about the only thing that
has as disastrous a user experience as gpg is DNSSEC.  :-) I just
manually upload keys to the kernel and Debian keyrings, and it's been
working out, apparently without much pain for either me or to those
who rely on my keys --- at least, no one as complained to me so
far....

					- Ted