Hacker Poesywot
https://status.hackerposse.com/tag/wot/rss
Updates tagged with wot on Hacker Poesy!rozzin: So, "what am I doing when I get a new key from someone and check the signatures to see if there are any people in common" depends heavily on what you mean by "check the signatures" and "people in common". If you mean "trace through signature-chains with no #trust #metrics to find *reachable* signatures", then no you're not using #WoT verification, you're making your own inferences based on something else.
https://status.hackerposse.com/notice/133956
rozzin's status on Wednesday, 03-Jul-2019 10:32:33 EDTSo, "what am I doing when I get a new key from someone and check the signatures to see if there are any people in common" depends heavily on what you mean by "check the signatures" and "people in common". If you mean "trace through signature-chains with no #<span class="tag"><a href="https://status.hackerposse.com/tag/trust" rel="tag">trust</a></span> #<span class="tag"><a href="https://status.hackerposse.com/tag/metrics" rel="tag">metrics</a></span> to find *reachable* signatures", then no you're not using #<span class="tag"><a href="https://status.hackerposse.com/tag/wot" rel="tag">WoT</a></span> verification, you're making your own inferences based on something else.2019-07-03T10:32:33-04:00Joshua Judson Rosenrozzin: That #Tails "use the WoT" download #verification guide is telling you to do 2 distinct things: 1) use #PGP WoT metrics to identify someone who is a Tails developer (but not AFAICT to identify that person *as* a Tails developer); 2) make a WoT-less leap from "this is Bob" to "Bob is verified as a Tails developer AND his signatures mean something". In that "→A→B→C" chain of mixed ops, #WoT only takes you to B.
https://status.hackerposse.com/notice/133950
rozzin's status on Wednesday, 03-Jul-2019 01:15:55 EDTThat #<span class="tag"><a href="https://status.hackerposse.com/tag/tails" rel="tag">Tails</a></span> "use the WoT" download #<span class="tag"><a href="https://status.hackerposse.com/tag/verification" rel="tag">verification</a></span> guide is telling you to do 2 distinct things: <br /> 1) use #<span class="tag"><a href="https://status.hackerposse.com/tag/pgp" rel="tag">PGP</a></span> WoT metrics to identify someone who is a Tails developer (but not AFAICT to identify that person *as* a Tails developer);<br /> 2) make a WoT-less leap from "this is Bob" to "Bob is verified as a Tails developer AND his signatures mean something".<br /> <br /> In that "→A→B→C" chain of mixed ops, #<span class="tag"><a href="https://status.hackerposse.com/tag/wot" rel="tag">WoT</a></span> only takes you to B.2019-07-03T01:15:55-04:00Joshua Judson Rosenrozzin: It may also matter that when I say "#PGP", I really mean "#GnuPG" because AFAICT GPG is the PGP that everyone actually uses these days. There are "trust signatures" in #OpenPGP, and GPG can make and use them..., but they're a whole different thing from "trust", "signatures", and #WoT. And I don't think I've ever actually seen one in the wild. Some other PGP implementation might use tsigs by default? But I doubt it?
https://status.hackerposse.com/notice/133949
rozzin's status on Wednesday, 03-Jul-2019 00:56:58 EDTIt may also matter that when I say "#<span class="tag"><a href="https://status.hackerposse.com/tag/pgp" rel="tag">PGP</a></span>", I really mean "#<span class="tag"><a href="https://status.hackerposse.com/tag/gnupg" rel="tag">GnuPG</a></span>" because AFAICT GPG is the PGP that everyone actually uses these days. There are "trust signatures" in #<span class="tag"><a href="https://status.hackerposse.com/tag/openpgp" rel="tag">OpenPGP</a></span>, and GPG can make and use them..., but they're a whole different thing from "trust", "signatures", and #<span class="tag"><a href="https://status.hackerposse.com/tag/wot" rel="tag">WoT.</a></span> And I don't think I've ever actually seen one in the wild. Some other PGP implementation might use tsigs by default? But I doubt it?2019-07-03T00:56:58-04:00Joshua Judson Rosenrozzin: That #PGP's #WoT metrics (supposedly) propagate through signature-chains is somehow basically an extremely popular #myth; "talks about WoT being all about arbitrarily-long multi-hop chains of trust" and "conflates #trust and #identity #certification" have been "understands-pgp-p" litmus tests for me since I realized how confused *I was myself* years ago, and they've never failed before.
https://status.hackerposse.com/notice/133948
rozzin's status on Wednesday, 03-Jul-2019 00:49:32 EDTThat #<span class="tag"><a href="https://status.hackerposse.com/tag/pgp" rel="tag">PGP</a></span>'s #<span class="tag"><a href="https://status.hackerposse.com/tag/wot" rel="tag">WoT</a></span> metrics (supposedly) propagate through signature-chains is somehow basically an extremely popular #<span class="tag"><a href="https://status.hackerposse.com/tag/myth" rel="tag">myth</a></span>; "talks about WoT being all about arbitrarily-long multi-hop chains of trust" and "conflates #<span class="tag"><a href="https://status.hackerposse.com/tag/trust" rel="tag">trust</a></span> and #<span class="tag"><a href="https://status.hackerposse.com/tag/identity" rel="tag">identity</a></span> #<span class="tag"><a href="https://status.hackerposse.com/tag/certification" rel="tag">certification</a></span>" have been "understands-pgp-p" litmus tests for me since I realized how confused *I was myself* years ago, and they've never failed before.2019-07-03T00:49:32-04:00Joshua Judson Rosenrozzin: @boneidol The signature-flooding attack on the SKS #keyservers (and DoS of their users) is bad but doesn't actually sound like any kind of #apocalypse, and has basically nothing to do with the #WoT; signature-chains maybe, but that's something else entirely. !crypto
https://status.hackerposse.com/notice/133911
rozzin's status on Monday, 01-Jul-2019 15:40:24 EDT@<a href="https://indy.im/boneidol" class="h-card mention" title="kat">boneidol</a> The signature-flooding attack on the SKS #<span class="tag"><a href="https://status.hackerposse.com/tag/keyservers" rel="tag">keyservers</a></span> (and DoS of their users) is bad but doesn't actually sound like any kind of #<span class="tag"><a href="https://status.hackerposse.com/tag/apocalypse" rel="tag">apocalypse</a></span>, and has basically nothing to do with the #<span class="tag"><a href="https://status.hackerposse.com/tag/wot" rel="tag">WoT</a></span>; signature-chains maybe, but that's something else entirely. !<a href="http://sn.jonkman.ca/group/348/id" class="h-card group" title="Cryptography (crypto)">crypto</a>2019-07-01T15:40:24-04:00Joshua Judson Rosenzack: Dustin Kirkland: «Introducing Hockeypuck -- a new #HKP server» http://ur1.ca/cs99t #WoT #gpg
https://status.hackerposse.com/notice/37694
zack's status on Tuesday, 12-Feb-2013 03:08:33 ESTDustin Kirkland: «Introducing Hockeypuck -- a new #<span class="tag"><a href="http://identi.ca/tag/hkp" rel="tag">HKP</a></span> server» <a href="http://ur1.ca/cs99t" title="http://blog.dustinkirkland.com/2013/02/introducing-hockeypuck-new-hkp-server.html" rel="nofollow external">http://ur1.ca/cs99t</a> #<span class="tag"><a href="http://identi.ca/tag/wot" rel="tag">WoT</a></span> #<span class="tag"><a href="http://identi.ca/tag/gpg" rel="tag">gpg</a></span>2013-02-12T03:08:33-05:00Stefano Zacchirolizack: …and http://ur1.ca/bg7wm is back, YAY! #gnupg #WoT
https://status.hackerposse.com/notice/30819
zack's status on Saturday, 08-Dec-2012 05:16:37 EST…and <a href="http://ur1.ca/bg7wm" title="http://pgp.cs.uu.nl/" rel="nofollow external">http://ur1.ca/bg7wm</a> is back, YAY! #<span class="tag"><a href="http://identi.ca/tag/gnupg" rel="tag">gnupg</a></span> #<span class="tag"><a href="http://identi.ca/tag/wot" rel="tag">WoT</a></span>2012-12-08T05:16:37-05:00Stefano ZacchirolirozzinJoshua Judson RosenzackStefano Zacchiroli