auto-key-retrieve considered harmful

[Christian Biere]

Jeffrey Stedfast wrote:
> gpg: WARNING: This key is not certified with a trusted signature!
> gpg:          There is no indication that the signature belongs to the
> owner.

Yes, something like that should be shown. As that message comes from
gpg, you don't really have to put a lot of work into this and I see
no reason to hide this warning from the user.

> I don't know about other mail clients, but Evolution shows that when a
> key is untrusted

I didn't claim that *every* software besides Mutt is broken!

> (probably due to an auto-key-retrieve)

Huh? One is not related to the other. Do you think gpg shouldn't warn
you if you downloaded the key by hand?

Just in case I made myself very unclear: I didn't say that there's
any bug WRT auto-key-retrieve in gpg. But the feature *could* be
harmful in combination with the wrong software. A warning that
this feature should be used with caution due to bad software
that didn't check the trust levels wouldn't hurt anyone. I mean,
it's no *that* obvious, IMHO, is it?

Slightly OT: If the software doesn't show the signature status
in a way so that this can't be included/faked in the original message,
the software is broken, too. E.g., if you used Mutt in black/white
mode without any attributes, the only (obvious) indicator would be
a wrong date/time in the status message.

Christian
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 303 bytes
Desc: not available
Url : /pipermail/attachments/20031207/662f02d5/attachment.bin