Re: [Sks-devel] SKS should not accept or replay non-exportable certifications

[John Clizbe]

Daniel Kahn Gillmor wrote:>
> Someone™ (0x75D292D353ADACCD) made a non-exportable certification on
> your user ID "John P. Clizbe <address@hidden>"
> (2048R/0x2313315C435BD034).  Someone else uploaded that key to a
> keyserver (ok, i admit it was me :P).  The keyserver network is
> currently propagating that non-exportable certification, in
> contravention of the OpenPGP standard.

Well, thank you for at least admitting your key vandalism.

And because "you", err "Someone™", made and uploaded a regular local signature
as opposed to a self-sig, it gets cleaned when I refresh my key. GPG won't
import your bogus sig -- I suppose it could be forced to do it, but I'm really
not interested in your self-created corner-case. To me, that's the system
operating as it should. There's LOTS of cruft out there on the keyservers and
in most cases, the clients handle it.

BTW: childish stunts such as this ARE NOT the way to sway or to win my
opinion. They are more likely to lead me to the opinion that the perpetrator
is overly prone to extreme histrionic outbursts.
(As some friends of mine would say, "OH MARY! @_@ The drama-llama called. He
wants his hump back." or "Drama Queen, take your Drama-meen.")

>> There is nothing to fix here, either in SKS or in GnuPG. The thread on
>> GnuPG-users has the needed discussion.
>
> I don't think this conclusion is warranted.

Then code the patch and quit the hissy-fit. Note -- honoring the
not-exportable flag on a self-sig breaks the standard in IMO a worse way,
UID(s) without binding sig(s).

I agree with Werner and Dave Shaw that you are wrong. If you are so convinced
you are correct, post, with _ALL_ the particulars not just those that support
your stance, to the IETF-OpenPGP list and get their opinion.

As some of the other posters on the GnuPG-Users thread pointed out, there are
other ways _within_ the standard to handle what you want to get accomplished.
Key vandalism and histrionics do not advance your cause.

-- 
John P. Clizbe                      Inet: John (a) Gingerbear DAWT net
SKS/Enigmail/PGP-EKP                  or: John ( @ ) Enigmail DAWT net
FSF Assoc #995 / FSFE Fellow #1797  hkp://keyserver.gingerbear.net  or
     mailto:address@hidden

Q:"Just how do the residents of Haiku, Hawai'i hold conversations?"
A:"An odd melody / island voices on the winds / surplus of vowels"

signature.asc
Description: OpenPGP digital signature