stripping GD sigs (was: Re: clean sigs)

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
8 messages Options
Reply | Threaded
Open this post in threaded view
|

stripping GD sigs (was: Re: clean sigs)

Jason Harris
On Thu, Sep 08, 2005 at 08:00:25PM -0400, David Shaw wrote:
> On Fri, Sep 09, 2005 at 12:33:47AM +0200, Dirk Traulsen wrote:

> > 3. Because now I was irritated, I did the same again with a different
> > keyserver 'keyserver.kjsl.com' and I got a completely different
> > result! When I fetched the key 08B0A90B, here it didn't have 47 sigs,
> > but only 15 sigs (see below output2). There was only a double self
> > sig, which 'clean' removed later. How can this be, if the keyservers
> > are synchronized?
>
> Looks like they're not all that well synchronized :)

Well, keyserver.ubuntu.com is still not participating in email syncs
to non-SKS keyservers, but that's a different problem.

keyserver.kjsl.com is now stripping all GD sigs.  The extra variable
in kd_search.c and code for 'case 2:' of make_keys_elem(), respectively:

static unsigned char gdkeyid[8] = {0x97, 0x10, 0xB8, 0x9B,
                                   0xCA, 0x57, 0xAD, 0x7C};


       if ((keyid.size == 8) && (keyid.offset == 0) &&
           (memcmp (keyid.data, gdkeyid, 8) == 0)) {
         break;
       }

--
Jason Harris           |  NIC:  JH329, PGP:  This _is_ PGP-signed, isn't it?
[hidden email] _|_ web:  http://keyserver.kjsl.com/~jharris/
          Got photons?   (TM), (C) 2004

_______________________________________________
Sks-devel mailing list
[hidden email]
http://lists.nongnu.org/mailman/listinfo/sks-devel

attachment0 (322 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: stripping GD sigs (was: Re: clean sigs)

David Shaw
On Thu, Sep 08, 2005 at 10:08:24PM -0400, Jason Harris wrote:

> On Thu, Sep 08, 2005 at 08:00:25PM -0400, David Shaw wrote:
> > On Fri, Sep 09, 2005 at 12:33:47AM +0200, Dirk Traulsen wrote:
>
> > > 3. Because now I was irritated, I did the same again with a different
> > > keyserver 'keyserver.kjsl.com' and I got a completely different
> > > result! When I fetched the key 08B0A90B, here it didn't have 47 sigs,
> > > but only 15 sigs (see below output2). There was only a double self
> > > sig, which 'clean' removed later. How can this be, if the keyservers
> > > are synchronized?
> >
> > Looks like they're not all that well synchronized :)
>
> Well, keyserver.ubuntu.com is still not participating in email syncs
> to non-SKS keyservers, but that's a different problem.
>
> keyserver.kjsl.com is now stripping all GD sigs.  The extra variable
> in kd_search.c and code for 'case 2:' of make_keys_elem(), respectively:

It's your keyserver, and you of course make the choices for what it
carries, but for the record, I think this is a bad idea.  Skipping the
usual discussion about the GD (I don't think anyone will convince
anyone else at this point), you do realize that this means you are
making a decision to edit the web of trust for others based on your
own personal criteria.

I'd be all in favor of an option where users could elect to filter out
keys: that would put the user in control.  Forcing your decision on
others by stripping signatures is a very disturbing step.

David


_______________________________________________
Sks-devel mailing list
[hidden email]
http://lists.nongnu.org/mailman/listinfo/sks-devel
Reply | Threaded
Open this post in threaded view
|

Re: stripping GD sigs (was: Re: clean sigs)

Jason Harris
On Thu, Sep 08, 2005 at 10:28:29PM -0400, David Shaw wrote:
> On Thu, Sep 08, 2005 at 10:08:24PM -0400, Jason Harris wrote:

> > keyserver.kjsl.com is now stripping all GD sigs.  The extra variable
> > in kd_search.c and code for 'case 2:' of make_keys_elem(), respectively:
>
> It's your keyserver, and you of course make the choices for what it
> carries, but for the record, I think this is a bad idea.  Skipping the
> usual discussion about the GD (I don't think anyone will convince
> anyone else at this point), you do realize that this means you are
> making a decision to edit the web of trust for others based on your
> own personal criteria.
>
> I'd be all in favor of an option where users could elect to filter out
> keys: that would put the user in control.  Forcing your decision on
> others by stripping signatures is a very disturbing step.
Not at all.  Anyone who wants sigs from the GD should use that
keyserver.  They're still available from it, and, remember,
expired sigs don't affect the WoT, so what's the point of the
well-synchronized keyservers keeping GD sigs?

--
Jason Harris           |  NIC:  JH329, PGP:  This _is_ PGP-signed, isn't it?
[hidden email] _|_ web:  http://keyserver.kjsl.com/~jharris/
          Got photons?   (TM), (C) 2004

_______________________________________________
Sks-devel mailing list
[hidden email]
http://lists.nongnu.org/mailman/listinfo/sks-devel

attachment0 (322 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: stripping GD sigs (was: Re: clean sigs)

David Shaw
On Thu, Sep 08, 2005 at 11:10:23PM -0400, Jason Harris wrote:

> On Thu, Sep 08, 2005 at 10:28:29PM -0400, David Shaw wrote:
> > On Thu, Sep 08, 2005 at 10:08:24PM -0400, Jason Harris wrote:
>
> > > keyserver.kjsl.com is now stripping all GD sigs.  The extra variable
> > > in kd_search.c and code for 'case 2:' of make_keys_elem(), respectively:
> >
> > It's your keyserver, and you of course make the choices for what it
> > carries, but for the record, I think this is a bad idea.  Skipping the
> > usual discussion about the GD (I don't think anyone will convince
> > anyone else at this point), you do realize that this means you are
> > making a decision to edit the web of trust for others based on your
> > own personal criteria.
> >
> > I'd be all in favor of an option where users could elect to filter out
> > keys: that would put the user in control.  Forcing your decision on
> > others by stripping signatures is a very disturbing step.
>
> Not at all.  Anyone who wants sigs from the GD should use that
> keyserver.  They're still available from it, and, remember,
> expired sigs don't affect the WoT, so what's the point of the
> well-synchronized keyservers keeping GD sigs?

You're not dropping expired signatures.  You're dropping all
signatures from a particular key - expired or not.  Those signatures
are part of the web of trust.  The web of trust now has a different
view from your keyserver than from the rest of the world.

If I ran a keyserver, would it be appropriate for me to drop all
signatures from your key D39DA0E3 simply because they're available
somewhere else?

Personal opinions as to the usefulness of signatures should not be a
factor in what a keyserver stores.  It's a very dangerous path to go
down: do you also strip signatures from someone "known" to be a bad
signer?  What's the criteria for inclusion in your keyserver?  Is it
stated somewhere so users can read it?

David


_______________________________________________
Sks-devel mailing list
[hidden email]
http://lists.nongnu.org/mailman/listinfo/sks-devel
Reply | Threaded
Open this post in threaded view
|

Re: stripping GD sigs (was: Re: clean sigs)

Jason Harris
On Thu, Sep 08, 2005 at 11:23:08PM -0400, David Shaw wrote:
> On Thu, Sep 08, 2005 at 11:10:23PM -0400, Jason Harris wrote:

> > Not at all.  Anyone who wants sigs from the GD should use that
> > keyserver.  They're still available from it, and, remember,
> > expired sigs don't affect the WoT, so what's the point of the
> > well-synchronized keyservers keeping GD sigs?
>
> You're not dropping expired signatures.  You're dropping all
> signatures from a particular key - expired or not.  Those signatures
> are part of the web of trust.  The web of trust now has a different
> view from your keyserver than from the rest of the world.

Indeed, all keyservers (except the GD) should drop GD sigs.

> If I ran a keyserver, would it be appropriate for me to drop all
> signatures from your key D39DA0E3 simply because they're available
> somewhere else?

keyserver.pgp.com doesn't synchronize with other keyservers, by design,
which they maintain to be a GoodThing(TM).  Are you currently insinuating
that the GD sigs should spam the well-synchronized keyservers?

> Personal opinions as to the usefulness of signatures should not be a
> factor in what a keyserver stores.  It's a very dangerous path to go
> down: do you also strip signatures from someone "known" to be a bad
> signer?  What's the criteria for inclusion in your keyserver?  Is it
> stated somewhere so users can read it?

Right now, TTBOMK, only the GD is, indeed, ""known" to be a bad signer."

--
Jason Harris           |  NIC:  JH329, PGP:  This _is_ PGP-signed, isn't it?
[hidden email] _|_ web:  http://keyserver.kjsl.com/~jharris/
          Got photons?   (TM), (C) 2004

_______________________________________________
Sks-devel mailing list
[hidden email]
http://lists.nongnu.org/mailman/listinfo/sks-devel

attachment0 (322 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: stripping GD sigs (was: Re: clean sigs)

David Shaw
On Fri, Sep 09, 2005 at 12:22:00AM -0400, Jason Harris wrote:

> > If I ran a keyserver, would it be appropriate for me to drop all
> > signatures from your key D39DA0E3 simply because they're available
> > somewhere else?
>
> keyserver.pgp.com doesn't synchronize with other keyservers, by design,
> which they maintain to be a GoodThing(TM).  Are you currently insinuating
> that the GD sigs should spam the well-synchronized keyservers?

Obviously not.  The GD is an island that synchronizes with nobody.
The whole design of it is radically different than the other
keyservers out there in that it is not designed to store all keys.  It
is designed to store one key per active user, and that is enforced.
Synchronizing would destroy that design goal.  Not synchronizing is
also the only way they can avoid certain semantic problems with robot
CAs.

Still, Jason, you can't have it both ways: you complain that the GD
won't sync, and you complain that the GD signatures leak out.  Which
do you want to fix?

> > Personal opinions as to the usefulness of signatures should not be a
> > factor in what a keyserver stores.  It's a very dangerous path to go
> > down: do you also strip signatures from someone "known" to be a bad
> > signer?  What's the criteria for inclusion in your keyserver?  Is it
> > stated somewhere so users can read it?
>
> Right now, TTBOMK, only the GD is, indeed, ""known" to be a bad signer."

Known by *you*.  I rather think the GD is a good signer, for what it
is.  I know a whole lot of other people who think the GD is a good
signer, just as I know a whole lot of people who think the GD is a bad
signer.  Is your keyserver for you personally or for the public?

Do understand, this isn't about the GD specifically: it's about a
keyserver operator who is editing their database to present a
different trust view than is really there.  When do your personal
preferences start impacting a public service?  If a user fetches a key
from sks.dnsalias.net they see one view of the world.  If they fetch
the same key from your keyserver, they see your private view of the
world.

Or to put it another way: I know dozens of bad signers (I could tell
some horror stories here).  Should you drop their signatures too?

With regards to the GD problem, specifically: Jason, I've seen you do
amazing things with debugging the keyserver net, and point to exactly
where particular signatures entered the net.  Why don't you just see
where the signatures are leaking in from before you redefine what a
keyserver stores to suit yourself?  They're not coming from the GD,
and PGP and GnuPG have no way to bridge them automatically.  Therefore
someone is doing it manually, and on a regular basis.

If you insist on presenting a different view to users than the entire
rest of the keyserver net, without any way to turn such a "feature"
off, then I suggest that keyserver.kjsl.com be removed from the
subkeys.pgp.net rotation.  It will cause more confusion than benefit.

David


_______________________________________________
Sks-devel mailing list
[hidden email]
http://lists.nongnu.org/mailman/listinfo/sks-devel
Reply | Threaded
Open this post in threaded view
|

Re: stripping GD sigs (was: Re: clean sigs)

Jason Harris
On Fri, Sep 09, 2005 at 08:31:35AM -0400, David Shaw wrote:
> On Fri, Sep 09, 2005 at 12:22:00AM -0400, Jason Harris wrote:

[I'll address your other points later.]
 
> If you insist on presenting a different view to users than the entire
> rest of the keyserver net, without any way to turn such a "feature"
> off, then I suggest that keyserver.kjsl.com be removed from the
> subkeys.pgp.net rotation.  It will cause more confusion than benefit.

I pointed out the potential for confusion before.  But, now, I'm
convinced the best solution _is_ to remove the GD sigs from non-
GD keyservers.  Also, subkeys.pgp.net is about _subkeys_.  If you
want gd-retention.pgp.net, go ahead and ask Piete to create it,
then configure GPG to use it by default.

As well, please give OpenPGP users more credit.  They seem to be
quite capable of comprehending the differences among keyservers.

--
Jason Harris           |  NIC:  JH329, PGP:  This _is_ PGP-signed, isn't it?
[hidden email] _|_ web:  http://keyserver.kjsl.com/~jharris/
          Got photons?   (TM), (C) 2004

_______________________________________________
Sks-devel mailing list
[hidden email]
http://lists.nongnu.org/mailman/listinfo/sks-devel

attachment0 (322 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: stripping GD sigs (was: Re: clean sigs)

David Shaw
On Fri, Sep 09, 2005 at 09:30:35AM -0400, Jason Harris wrote:

> On Fri, Sep 09, 2005 at 08:31:35AM -0400, David Shaw wrote:
> > On Fri, Sep 09, 2005 at 12:22:00AM -0400, Jason Harris wrote:
>
> [I'll address your other points later.]
>  
> > If you insist on presenting a different view to users than the entire
> > rest of the keyserver net, without any way to turn such a "feature"
> > off, then I suggest that keyserver.kjsl.com be removed from the
> > subkeys.pgp.net rotation.  It will cause more confusion than benefit.
>
> I pointed out the potential for confusion before.  But, now, I'm
> convinced the best solution _is_ to remove the GD sigs from non-
> GD keyservers.

You seem to continue to ignore my point, probably because it's easier
for you to argue this as a GD issue.  Let me try again:

1) This isn't about the GD.
2) Nope, not about the GD.
3) Still, not about the GD.
4) It's about one lone keyserver operator, without any discussion with
   other operators, editing his own keyserver to remove material he
   doesn't like.
5) Did I mention it wasn't about the GD?

> Also, subkeys.pgp.net is about _subkeys_.  If you want
> gd-retention.pgp.net, go ahead and ask Piete to create it, then
> configure GPG to use it by default.

Jason, what would you do if one particular keyserver in
subkeys.pgp.net refused to sync with the others, so it presented a
different view?  What would you do if one particular keyserver decided
to drop all signatures from you because they don't think you're a good
signer (0x11 signatures - argh).  Should they be dropped from
subkeys.pgp.net?  Are they breaching their responsibility to the rest
of the keyserver net?  Remember: not a GD issue.  You're editing your
keyserver based on *your* personal preferences.  Again, by the way,
not a GD issue.

> As well, please give OpenPGP users more credit.  They seem to be
> quite capable of comprehending the differences among keyservers.

You do realize, I hope, that the very email that started this thread
was from someone confused about why the keyservers weren't giving back
the same material...

David


_______________________________________________
Sks-devel mailing list
[hidden email]
http://lists.nongnu.org/mailman/listinfo/sks-devel