the importance of gpg or The Web of Trust

On Fri, 2002-10-11 at 03:25, Max wrote:
> On Thu, Oct 10, 2002 at 07:11:01PM -0500, Paul Roberts wrote:
> 
> > The real solution to this is to start sending emails to the maintainers of
> > every package you build that does _not_ have a published public key and
> > signature file, and ask them to start signing their releases.
> 
> Thats what I'm doing since the irssi trojan. I keep a list of projects,
> emails, date and reply status of everybody I sent an email concerning
> pgp signatures to. The scary thing is that _not a single project_ that
> I have asked has started to provide pgp sigs yet! That includes huge and
> widely used projects like samba and mozilla as well as smaller projects
> like licq and xchat. Some "developers" dont even know of pgp. I hope
> our pgp-advocating crackers will show them, the hard way. :)

Cracking is not the answer but then I think you knew that already.

> What do you think of a webpage containing
> 1) a list of projects that have pgp sigs
> 2) a list of projects that dont have pgp sigs + contact information
> 3) a mini-howto explaining how to use (and the importance of) gpg/pgp
> 
> pgp-aware users could use this list to easily get contact information
> for every project so they can send them email requesting pgp sigs. and
> project maintainers could put a link to the pgp howto so their pgp-unaware
> users could learn how to verify the pgp sigs.
> 
> the first two points should be 'interactive', so everybody can add a
> project to the database and update its status.

I am going to a "key signing" party next week in Billings.  Been reading
a lot of material advocating webs of trust, key signing, community
building, blah, blah, and so on.

Anyway, as regards package signing I think this sort of thing is an
excellent idea.

I will have a lot more to say about this in the future.  Right now I
need to go to bed.

-- 
I think, therefore, ken_i_m
Chief Gadgeteer,
Elegant Innovations

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQA9pp8Z8MCUo3oeQ4kRAqUBAJ4sO0/hlLRDjsgSnL734JgPD4f5FgCeOfdV
CTJYAvxH5HPbg5mtLqdAAGw=
=0Atw
-----END PGP SIGNATURE-----