Re: surfnet keyserver

On Fri, Mar 05, 2004 at 12:42:40PM -0500, Ethan Weinstein wrote:

> Please pardon the candor, but..
> For the love of GOD can't someone just fix PKS's subkey problem?  I 
> think it's a horrible waste for such decent software to go by the 
> wayside due to the lack of this feature.  If I were an experienced 
> programmer I'd certainly do it myself, no question.  The db4 version 
> I've been running is fast and stable, and has had a number of nasty bugs 
> already fixed.  How difficult could it be to finally slay this one?  I 
> know Jason has mostly done it.
> 
> With all due respect to Yaron, I feel that it's just too early in the 
> game for me to use something as new as sks.  It seems to be quite a good 
> system, but I just won't use it until it has aged quite a bit.  For all 
> I know it has nastier DoS's/exploits than PKS already does just waiting 
> to be found.

Since I couldn't persuade people to stop using it, I spent a good bit
of time patching PKS to at least not destroy keys with subkeys and a
collection of other fixes to at least get PKS to the point where it
didn't actively do harm.

Now that PKS is just broken, and not a hazard, I don't know that I'm
that interested in taking it further.  Certainly not when I can point
people to an SKS server and not have to give them the old lecture
"well, if you have subkeys, use this server, unless you have a photo
ID, and in that case use this other server.  If you have a V4 RSA key,
you'll need to use this server, but no matter what I tell you, it
won't help since all the servers share data in various levels of
brokenness, so your key is going to be corrupted somewhere."  That's
insanely difficult for a new PGP user to understand, and I'm seeing
more and more people give up on the keyserver system and just stick
keys on a web page.

If someone fixed *all* the PKS problems, I'd be thrilled, but since
that clearly isn't going to happen at this point, why stress about it?
Personally, I'm not that reluctant to trade software with known fatal
flaws for one with unknown flaws.  At least I have a fighting chance
for improvement.

David