Re: Keyserver for gpg.conf ?

Path	csiph.com!news.samoylyk.net!gothmog.csi.it!bofh.it!news.nic.it!robomod
From	Jeremy Stanley <fungi@yuggoth.org>
Newsgroups	linux.debian.security
Subject	Re: Keyserver for gpg.conf ?
Date	Mon, 17 Nov 2025 16:30:02 +0100
Message-ID	<LS9l0-dF3N-7@gated-at.bofh.it> (permalink)
References	<LRkVb-d7Jl-5@gated-at.bofh.it> <LRsSK-ddir-17@gated-at.bofh.it> <LRvnA-deMI-9@gated-at.bofh.it> <LRBjj-diRy-1@gated-at.bofh.it>
X-Mailbox-Line	From debian-security-request@lists.debian.org Mon Nov 17 15:27:27 2025
Old-Return-Path	<fungi@yuggoth.org>
X-Amavis-Spam-Status	No, score=-11.9 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, FOURLA=0.1, LDO_WHITELIST=-5, PGPSIGNATURE=-5] autolearn=ham autolearn_force=no
X-Policyd-Weight	using cached result; rate:hard: -4.6
X-Greylist	delayed 1320 seconds by postgrey-1.36 at bendel; Mon, 17 Nov 2025 15:27:07 UTC
Reply-To	debian-security@lists.debian.org
Mail-Followup-To	debian-security@lists.debian.org
MIME-Version	1.0
Content-Type	multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="CbHkxOfPlO7uEue9"
Content-Disposition	inline
X-Sa-Exim-Connect-IP	66.70.103.60
X-Sa-Exim-Rcpt-To	debian-security@lists.debian.org
X-Sa-Exim-Mail-From	fungi@yuggoth.org
X-Sa-Exim-Scanned	No (on azathoth.yuggoth.org); SAEximRunCond expanded to false
X-Mailing-List	<debian-security@lists.debian.org> archive/latest/29692
List-ID	<debian-security.lists.debian.org>
List-URL	<https://lists.debian.org/debian-security/>
List-Archive	https://lists.debian.org/msgid-search/aRs5nXfXuBkgXD42@yuggoth.org
Approved	robomod@news.nic.it
Lines	64
Organization	linux.* mail to news gateway
Sender	robomod@news.nic.it
X-Original-Date	Mon, 17 Nov 2025 15:05:01 +0000
X-Original-Message-ID	<aRs5nXfXuBkgXD42@yuggoth.org>
X-Original-References	<20251115103427.4fc727b3c8f9d3cb2e2fd642@paranoici.org> <aRjAsl94EvWoZvKV@iiec.unam.mx> <aRjlDgZGEU7Qr26t@layer-acht.org> <176326183159.7.10109959858701937182.1009052101@simplelogin.com>
Xref	csiph.com linux.debian.security:6488

Show key headers only | View raw

[Multipart message — attachments visible in raw view] - view raw

On 2025-11-16 02:57:02 +0000 (+0000), debianmailinglists.hz5zm@simplelogin.com wrote:
> Do these other keyring servers leave the key intact? I stopped 
> using the key servers for my small personal projects and just have 
> my public key posted on my personal website because one of them ( 
> keys.openpgp.org I think ) lists my public key, but it seems to 
> have stripped all the identifying information from it so it can't 
> be searched for by email address and even if you download the copy 
> they have apps like Kleopatra fail to import it, and when 
> comparing it to my copy of the public key I manually exported the 
> contents are MUCH shorter on their copy.
[...]

The main reason for this, as I understand it, is to avoid the 
vulnerabilities which led to the fall of the SKS keyserver network. 
In short, the traditional keyserver model of allowing anyone to 
upload third-party signatures for keys they didn't control led 
eventually to vandals and other malicious persons uploading unwanted 
signatures with objectionable content or in volumes which overflowed 
the ability of clients and servers to deal with them (denial of 
service on the network and also on specific keys making them 
irretrievable). They did this in the most severe way possible, 
essentially filtering out all third-party signatures and even 
self-signatures and UIDs if the uploader can't prove control of the 
E-mail addresses associated with them (which implicitly means 
discarding non-E-mail identities too such as photo images).

Discussions I followed some time ago indicated they were willing to 
accept updates that enabled a caff-style approval process for 
third-party signatures at least, but it sounded like the existing 
team didn't have the resources to develop such a feature and that it 
would require additional volunteers working on that.
-- 
Jeremy Stanley

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar

Thread

Keyserver for gpg.conf ? Francesco Poli <invernomuto@paranoici.org> - 2025-11-15 10:40 +0100
  Re: Keyserver for gpg.conf ? Gunnar Wolf <gwolf@debian.org> - 2025-11-15 19:10 +0100
    Re: Keyserver for gpg.conf ? Holger Levsen <holger@layer-acht.org> - 2025-11-15 21:50 +0100
      Re: Keyserver for gpg.conf ? debianmailinglists.hz5zm@simplelogin.com - 2025-11-16 04:10 +0100
        Re: Keyserver for gpg.conf ? Gunnar Wolf <gwolf@debian.org> - 2025-11-16 17:10 +0100
        Re: Keyserver for gpg.conf ? Jeremy Stanley <fungi@yuggoth.org> - 2025-11-17 16:30 +0100
          Re: Keyserver for gpg.conf ? Jeffrey Walton <noloader@gmail.com> - 2025-11-17 16:40 +0100
      Re: Keyserver for gpg.conf ? Gunnar Wolf <gwolf@debian.org> - 2025-11-16 17:10 +0100
    Re: Keyserver for gpg.conf ? Francesco Poli <invernomuto@paranoici.org> - 2025-11-16 13:40 +0100
      Re: Keyserver for gpg.conf ? Gunnar Wolf <gwolf@debian.org> - 2025-11-16 17:10 +0100
  Re: Keyserver for gpg.conf ? Jeffrey Walton <noloader@gmail.com> - 2025-11-17 17:00 +0100
    Re: Keyserver for gpg.conf ? Francesco Poli <invernomuto@paranoici.org> - 2025-11-17 18:40 +0100
      Re: Keyserver for gpg.conf ? Jeremy Stanley <fungi@yuggoth.org> - 2025-11-17 18:50 +0100
      Re: Keyserver for gpg.conf ? debianmailinglists.hz5zm@simplelogin.com - 2025-11-18 01:50 +0100

csiph-web