You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@hbase.apache.org by Thomas Koch <th...@koch.ro> on 2010/06/25 11:29:55 UTC
Please get your gpg keys signed!
Hi,
I just wanted to package the new HBase version and since I've just recently
read about a malicious software tarball for some Linux IRC server[1], I got
back to the habbit of checking signatures. (Yes, I was lazy recently. I'm
ashamed.)
But checking the signatures of apache software obviously is meaningless, since
apache developers appears to not have their keys in the web-of-trust. From
three signature files I had laying around on my hard disc, all three keys had
zero signatures on the MIT keyserver:
30CD0996 2010-05-03 Michael Stack <st...@duboce.net>
68E327C1 2008-10-22 Patrick Hunt <ph...@apache.org>
FE045966 2009-10-13 Grant Ingersoll <gs...@apache.org>
So please, when you've your next Hadoop / HBase / Lucene / Apache meetings,
take your time for a keysigning party[2]. Or just have some snippet with your
keys fingerprint in your wallet and hand it to every other geek you meet. (And
make sure he asks you for your ID card to check your identity!) It's also nice
to have your gpg fingerprint on your business cards!
[1] http://www.sophos.com/blogs/chetw/g/2010/06/12/linux-malware-rears-ugly-
head/
[2] http://en.wikipedia.org/wiki/Key_signing_party
Thank you!
Thomas Koch, http://www.koch.ro
Re: Please get your gpg keys signed!
Posted by Torsten Curdt <tc...@apache.org>.
> But checking the signatures of apache software obviously is meaningless, since
> apache developers appears to not have their keys in the web-of-trust
Many many do :)
> So please, when you've your next Hadoop / HBase / Lucene / Apache meetings,
> take your time for a keysigning party[2].
We should have done some key signing during the buzzwords conference.
For people in Berlin: I am happy to exchange keys to get them into the
web-of-trust.
Will certainly suggest something like that for our Apache Dinners.
cheers
--
Torsten
Re: Please get your gpg keys signed!
Posted by Torsten Curdt <tc...@apache.org>.
> But checking the signatures of apache software obviously is meaningless, since
> apache developers appears to not have their keys in the web-of-trust
Many many do :)
> So please, when you've your next Hadoop / HBase / Lucene / Apache meetings,
> take your time for a keysigning party[2].
We should have done some key signing during the buzzwords conference.
For people in Berlin: I am happy to exchange keys to get them into the
web-of-trust.
Will certainly suggest something like that for our Apache Dinners.
cheers
--
Torsten
Re: Please get your gpg keys signed!
Posted by Patrick Hunt <ph...@apache.org>.
Thomas, are you attending the summit? There are a number of contributor
workshops the day after, all at (or around) the same location. If you
feel strongly about this consider attending them, seems like great
opportunity for a "key signing party".
http://www.meetup.com/Hadoop-Contributors/calendar/13771414/
http://www.meetup.com/Hadoop-Contributors/calendar/13750403/
http://www.meetup.com/hbaseusergroup/calendar/13562846/
etc...
Here's some detail on WOT at apache:
http://www.apache.org/dev/release-signing.html#web-of-trust
Patrick
On 06/25/2010 02:29 AM, Thomas Koch wrote:
> Hi,
>
> I just wanted to package the new HBase version and since I've just recently
> read about a malicious software tarball for some Linux IRC server[1], I got
> back to the habbit of checking signatures. (Yes, I was lazy recently. I'm
> ashamed.)
>
> But checking the signatures of apache software obviously is meaningless, since
> apache developers appears to not have their keys in the web-of-trust. From
> three signature files I had laying around on my hard disc, all three keys had
> zero signatures on the MIT keyserver:
>
> 30CD0996 2010-05-03 Michael Stack<st...@duboce.net>
> 68E327C1 2008-10-22 Patrick Hunt<ph...@apache.org>
> FE045966 2009-10-13 Grant Ingersoll<gs...@apache.org>
>
> So please, when you've your next Hadoop / HBase / Lucene / Apache meetings,
> take your time for a keysigning party[2]. Or just have some snippet with your
> keys fingerprint in your wallet and hand it to every other geek you meet. (And
> make sure he asks you for your ID card to check your identity!) It's also nice
> to have your gpg fingerprint on your business cards!
>
> [1] http://www.sophos.com/blogs/chetw/g/2010/06/12/linux-malware-rears-ugly-
> head/
> [2] http://en.wikipedia.org/wiki/Key_signing_party
>
> Thank you!
>
> Thomas Koch, http://www.koch.ro
Re: Please get your gpg keys signed!
Posted by Patrick Hunt <ph...@apache.org>.
Thomas, are you attending the summit? There are a number of contributor
workshops the day after, all at (or around) the same location. If you
feel strongly about this consider attending them, seems like great
opportunity for a "key signing party".
http://www.meetup.com/Hadoop-Contributors/calendar/13771414/
http://www.meetup.com/Hadoop-Contributors/calendar/13750403/
http://www.meetup.com/hbaseusergroup/calendar/13562846/
etc...
Here's some detail on WOT at apache:
http://www.apache.org/dev/release-signing.html#web-of-trust
Patrick
On 06/25/2010 02:29 AM, Thomas Koch wrote:
> Hi,
>
> I just wanted to package the new HBase version and since I've just recently
> read about a malicious software tarball for some Linux IRC server[1], I got
> back to the habbit of checking signatures. (Yes, I was lazy recently. I'm
> ashamed.)
>
> But checking the signatures of apache software obviously is meaningless, since
> apache developers appears to not have their keys in the web-of-trust. From
> three signature files I had laying around on my hard disc, all three keys had
> zero signatures on the MIT keyserver:
>
> 30CD0996 2010-05-03 Michael Stack<st...@duboce.net>
> 68E327C1 2008-10-22 Patrick Hunt<ph...@apache.org>
> FE045966 2009-10-13 Grant Ingersoll<gs...@apache.org>
>
> So please, when you've your next Hadoop / HBase / Lucene / Apache meetings,
> take your time for a keysigning party[2]. Or just have some snippet with your
> keys fingerprint in your wallet and hand it to every other geek you meet. (And
> make sure he asks you for your ID card to check your identity!) It's also nice
> to have your gpg fingerprint on your business cards!
>
> [1] http://www.sophos.com/blogs/chetw/g/2010/06/12/linux-malware-rears-ugly-
> head/
> [2] http://en.wikipedia.org/wiki/Key_signing_party
>
> Thank you!
>
> Thomas Koch, http://www.koch.ro
Re: Please get your gpg keys signed!
Posted by Torsten Curdt <tc...@apache.org>.
> But checking the signatures of apache software obviously is meaningless, since
> apache developers appears to not have their keys in the web-of-trust
Many many do :)
> So please, when you've your next Hadoop / HBase / Lucene / Apache meetings,
> take your time for a keysigning party[2].
We should have done some key signing during the buzzwords conference.
For people in Berlin: I am happy to exchange keys to get them into the
web-of-trust.
Will certainly suggest something like that for our Apache Dinners.
cheers
--
Torsten
Re: Please get your gpg keys signed!
Posted by Patrick Hunt <ph...@apache.org>.
Thomas, are you attending the summit? There are a number of contributor
workshops the day after, all at (or around) the same location. If you
feel strongly about this consider attending them, seems like great
opportunity for a "key signing party".
http://www.meetup.com/Hadoop-Contributors/calendar/13771414/
http://www.meetup.com/Hadoop-Contributors/calendar/13750403/
http://www.meetup.com/hbaseusergroup/calendar/13562846/
etc...
Here's some detail on WOT at apache:
http://www.apache.org/dev/release-signing.html#web-of-trust
Patrick
On 06/25/2010 02:29 AM, Thomas Koch wrote:
> Hi,
>
> I just wanted to package the new HBase version and since I've just recently
> read about a malicious software tarball for some Linux IRC server[1], I got
> back to the habbit of checking signatures. (Yes, I was lazy recently. I'm
> ashamed.)
>
> But checking the signatures of apache software obviously is meaningless, since
> apache developers appears to not have their keys in the web-of-trust. From
> three signature files I had laying around on my hard disc, all three keys had
> zero signatures on the MIT keyserver:
>
> 30CD0996 2010-05-03 Michael Stack<st...@duboce.net>
> 68E327C1 2008-10-22 Patrick Hunt<ph...@apache.org>
> FE045966 2009-10-13 Grant Ingersoll<gs...@apache.org>
>
> So please, when you've your next Hadoop / HBase / Lucene / Apache meetings,
> take your time for a keysigning party[2]. Or just have some snippet with your
> keys fingerprint in your wallet and hand it to every other geek you meet. (And
> make sure he asks you for your ID card to check your identity!) It's also nice
> to have your gpg fingerprint on your business cards!
>
> [1] http://www.sophos.com/blogs/chetw/g/2010/06/12/linux-malware-rears-ugly-
> head/
> [2] http://en.wikipedia.org/wiki/Key_signing_party
>
> Thank you!
>
> Thomas Koch, http://www.koch.ro
Re: Please get your gpg keys signed!
Posted by Thomas Koch <th...@koch.ro>.
Robert Muir:
> On Fri, Jun 25, 2010 at 5:29 AM, Thomas Koch <th...@koch.ro> wrote:
> > But checking the signatures of apache software obviously is meaningless,
> > since
> > apache developers appears to not have their keys in the web-of-trust.
> > From three signature files I had laying around on my hard disc, all
> > three keys had
>
> > zero signatures on the MIT keyserver:
> are you sure you know how to verify keys? please read the manual before
> cross-posting to this many mailing lists.
>
> for example, Grant's key is definitely signed. i know because i signed it
> myself:
>
> pub 4096R/FE045966 2009-10-13
>
> uid Grant Ingersoll (CODE SIGNING KEY) <gs...@apache.org>
> sig sig3 FE045966 2009-10-13 __________ __________ [selfsig]
> sig sig A867E8B1 2009-10-13 __________ __________ Grant Ingersoll (CODE
> SIGNING KEY) <gs...@apache.org>
> sig sig 3396054D 2009-11-05 __________ __________ Robert Muir (Code
> Signing Key) <rm...@apache.org>
> sig sig ECA39416 2009-11-05 __________ __________ Simon Willnauer (Code
> Signing Key) <si...@apache.org>
> sig sig C09FB546 2009-11-05 __________ __________ Isabel Drost (Apache
> release signing key) <is...@apache.org>
> sig sig 0C0885B4 2009-11-05 __________ __________ Isabel Drost <
> idrost@htwm.de>
> sig sig E1EE085F 2009-11-05 __________ __________ Uwe Schindler (CODE
> SIGNING KEY) <us...@apache.org>
>
> *
> *
Hallo Robert,
You're right with Grant and I'm sorry for have been confused by the
webinterface of the keyserver. However after double checking with the pgp.net
keyserver I still don't find any signatures for M. Stack and P. Hunt.
And even the four signatures on Grant's key don't help much because they seem
to form a disconnected cluster of Andi Vajda, Isabel Drost, Michael Busch,
Robert Muir, Simon Willnauer and Uwe Schindler without any signature coming in
from the outside. - Isabel once had a very good signed key, but this has
expired.
The goal would be, that the apache keys would somehow interconnect with some
Debian keys:
http://people.debian.org/~weasel/weboftrust/
Many of the keys in the Debian Keyring have hundrets of signatures. It may
well be, that the Apache Keyring can get as strong as the Debian Keyring after
only two or three Apache Conferences.
Best regards,
Thomas Koch, http://www.koch.ro
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lucene.apache.org
For additional commands, e-mail: dev-help@lucene.apache.org
Re: Please get your gpg keys signed!
Posted by Robert Muir <rc...@gmail.com>.
On Fri, Jun 25, 2010 at 5:29 AM, Thomas Koch <th...@koch.ro> wrote:
>
> But checking the signatures of apache software obviously is meaningless,
> since
> apache developers appears to not have their keys in the web-of-trust. From
> three signature files I had laying around on my hard disc, all three keys
> had
> zero signatures on the MIT keyserver:
>
>
are you sure you know how to verify keys? please read the manual before
cross-posting to this many mailing lists.
for example, Grant's key is definitely signed. i know because i signed it
myself:
pub 4096R/FE045966 2009-10-13
uid Grant Ingersoll (CODE SIGNING KEY) <gs...@apache.org>
sig sig3 FE045966 2009-10-13 __________ __________ [selfsig]
sig sig A867E8B1 2009-10-13 __________ __________ Grant Ingersoll (CODE
SIGNING KEY) <gs...@apache.org>
sig sig 3396054D 2009-11-05 __________ __________ Robert Muir (Code
Signing Key) <rm...@apache.org>
sig sig ECA39416 2009-11-05 __________ __________ Simon Willnauer (Code
Signing Key) <si...@apache.org>
sig sig C09FB546 2009-11-05 __________ __________ Isabel Drost (Apache
release signing key) <is...@apache.org>
sig sig 0C0885B4 2009-11-05 __________ __________ Isabel Drost <
idrost@htwm.de>
sig sig E1EE085F 2009-11-05 __________ __________ Uwe Schindler (CODE
SIGNING KEY) <us...@apache.org>
*
*
--
Robert Muir
rcmuir@gmail.com