linux-kernel - Re: kernel.org status: establishing a PGP web of trust

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20111002204205.GD16368@khazad-dum.debian.net>
Date:	Sun, 2 Oct 2011 17:42:05 -0300
From:	Henrique de Moraes Holschuh <hmh@....eng.br>
To:	"Rafael J. Wysocki" <rjw@...k.pl>
Cc:	"H. Peter Anvin" <hpa@...or.com>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Greg KH <gregkh@...e.de>
Subject: Re: kernel.org status: establishing a PGP web of trust

On Sun, 02 Oct 2011, Rafael J. Wysocki wrote:
> Yes, it does, except that it will leave the people not at the KS and
> unable to create their own small webs of trust somewhat in the dust.

Look outside LKML.  For example, try to locate a Debian developer near
you, it shouldn't be too dificult[0] and you are almost guaranteed to
join the web-of-trust strong set[1] if you get your key cross-signed
with a Debian Developer[2].

[0] http://www.debian.org/devel/developers.loc

[1] The strong set is the largest set of keys such that for any two keys
in the set, there is a path from one to the other, refer to:
http://pgp.cs.uu.nl/plot/

[2] Based on the report from 2/17/08, an examination of 201,989 publicly
available keys found a strong set of 110,957 keys (about 54% of the
sample). In this strong set, the average MSD was 6.3449. The most
connected key belongs to Peter Palfrader and has an MSD of 3.5588. One
interesting phenomenon is that all of the top (most connected) 25 keys
and all but 12 of the top 50 keys belong to people involved with the
Debian project. The Debian project relies very heavily on GPG for
authentication and demands that members be in the web of trust before
they can join.  Quoted from:
http://expertvoices.nsdl.org/cornell-info204/2008/02/28/pgpgpg-the-web-of-trust-and-the-strong-set/

-- 
  "One disk to rule them all, One disk to find them. One disk to bring
  them all and in the darkness grind them. In the Land of Redmond
  where the shadows lie." -- The Silicon Valley Tarot
  Henrique Holschuh
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/