On 2010-12-23 07:41:01 (-0600), Tom Marble <tmarble@info9.net> wrote:
On 12/21/2010 09:17 AM, Philip Paeps wrote:
The keysigning infrastructure seems to have held up well this year. I spent some time today preparing the infrastructure for FOSDEM 2011.
As you are now promoting the KSP here (and on twitter)
Ehm, I'm not promoting anything on twitter. I don't believe in systems that are designed for more overhead than data. I hope whoever is sending stuff to twitter is not doing so in my name. When in doubt, only this mailing list is authoritative.
allow me to suggest that the KSP organizers recommend that attendees consider generating stronger 4096 RSA keys [0] if they have not already and double check the GPG configuration for signature strength SHA-512 [1][2][3].
In preparing for the Debconf 10 KSP [4] several resources were assembled to help in this process [5][6]. I created a small program, kspsig, to help verify signature strength [7].
The keyserver could probably be modified to reject weak keys. Alternatively, I could also run a cronjob over the submitted keys nightly and email the UIDs if the keys are weak. I'll take a look at your program. - Philip -- Philip Paeps Please don't Cc me, I am philip@fosdem.org subscribed to the list.