From bernhard at intevation.de Wed Sep 2 17:37:54 2020 From: bernhard at intevation.de (Bernhard Reiter) Date: Wed, 2 Sep 2020 17:37:54 +0200 Subject: Running a keyserver for the Verein :) In-Reply-To: <4462932.ga6r42dKOQ@esus> References: <202008251220.22666.bernhard@intevation.de> <4462932.ga6r42dKOQ@esus> Message-ID: <202009021738.08777.bernhard@intevation.de> Hi Andre, Am Montag 31 August 2020 13:27:55 schrieb Andre Heinecke: > On Tuesday 25 August 2020 12:20:22 CEST Bernhard Reiter wrote: > > I hereby apply to do it for and in the name of the GnuPG e.Verein. > > we would be happy if Intevation would run a keyserver. thanks for the permission! :) We suggest to call the keyserver something like keys.verein.gnupg.org or pubkeys.verein.gnupg.org Feel free to set a DNS record to point to our server. (Our alternative name currently is https://pubkeys.intevation.de/). We'll mark the server as run by Intevation GmbH for the GnuPG e.V. and link to the https://gnupg.org/verein/ as responsible entity. > But regarding keyservers it is better to coordinate with Kristian In another communication you gave me the hint to ping him on freenode (thanks for this and for pinging Kristian about my email). > > Details: > > Intevation will cover the costs so far as contribution to the Verein. > > (We try to find out what the costs are anyway. Unless somebody knows.) > > Ok. As you know the Verein has money so if you do this we could cover > costs. Right now we have rented a server at hetzner (about 40?/month) and played with imports (13 GiByte, takes 8 hours) and code quality. We'll see how to implement the first blacklist functionality next and we are in brief contact with the hockeypuck author. Two details: * github sponsor programm can be used to give some money to hockeypuck. (I've tried, but there are problems with them charging us.) The verein could do this. I suggest 10-50 USD/month I think it would help covering costs for the reference hockeypuck server. (BTW: Intevation also gave a small test payment to Kristian for sks to test this path.) * Do you have a pointer to the "spammed" pubkeys and signatures that currently block pubkey transfer like the one from Kristian? (This would go into the first blacklist.) Best Regards, Bernhard -- www.intevation.de/~bernhard ? +49 541 33 508 3-3 Intevation GmbH, Osnabr?ck, DE; Amtsgericht Osnabr?ck, HRB 18998 Gesch?ftsf?hrer Frank Koormann, Bernhard Reiter, Dr. Jan-Oliver Wagner -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 659 bytes Desc: This is a digitally signed message part. URL: From aheinecke at gnupg.org Wed Sep 2 18:41:32 2020 From: aheinecke at gnupg.org (Andre Heinecke) Date: Wed, 02 Sep 2020 18:41:32 +0200 Subject: Running a keyserver for the Verein :) In-Reply-To: <202009021738.08777.bernhard@intevation.de> References: <202008251220.22666.bernhard@intevation.de> <4462932.ga6r42dKOQ@esus> <202009021738.08777.bernhard@intevation.de> Message-ID: <3239680.4SLFfMIBU6@esus> Hi, Thanks a lot for your work! It is great that we have a "reference server" now hosted by an independet entity. Even though it does not solve the keyserver problems I think that it helps. E.g. in the future we could roll out attestation signatures with this server and filter out unattested signatures. Still keeping in mind that federation is a thing and that we don't want to give the authority of all OpenPGP keys to a single point of attack. But, How to enter the current server? The option: keyserver https://pubkeys.intevation.de/ Only reports "no valid OpenPGP Data found" HKP / HKPS ports are closed. I'm not a fan of the verein subdomain. It makes it longer and uglier, especially for non-germans speakers. I still think "keys.gnupg.org" would be best. I don't really think that it is confusable with "keys.openpgp.net". OpenPGP is something different then GnuPG. And having it close to keys.gnupg.net would also be fine. The .org is the Organisation (The Verein) the .net is the Keyserver Network. Very fitting. On Wednesday 2 September 2020 17:37:54 CEST Bernhard Reiter wrote: > * github sponsor programm can be used to give some money to > hockeypuck. (I've tried, but there are problems with them charging us.) > The verein could do this. I suggest 10-50 USD/month I think it would help > covering costs for the reference hockeypuck server. This is indeed interesting, I'm more for 100$ / month for the corporate tier. Any opinions on this from others? I think its a good way to spend our money. > * Do you have a pointer to the "spammed" pubkeys and signatures that > currently block pubkey transfer like the one from Kristian? (This > would go into the first blacklist.) Well dkg's key, Patricks and Werners key were at least spammed afaik. I can't send you a weblink to them as I could not find one with the spam signatures (which is good :-) ) So we have to rely on someone else to give you pointers how to blacklist malicious stuff, sorry. Best Regards, Andre -- GnuPG.com - a brand of g10 Code, the GnuPG experts. g10 Code GmbH, Erkrath/Germany, AG Wuppertal HRB14459 GF Werner Koch, USt-Id DE215605608, www.g10code.com. GnuPG e.V., Rochusstr. 44, D-40479 D?sseldorf. VR 11482 D?sseldorf Vorstand: W.Koch, B.Reiter, A.Heinecke Mail: board at gnupg.org Finanzamt D-Altstadt, St-Nr: 103/5923/1779. Tel: +49-211-28010702 From bernhard at intevation.de Wed Sep 2 20:04:00 2020 From: bernhard at intevation.de (Bernhard Reiter) Date: Wed, 02 Sep 2020 20:04:00 +0200 Subject: Running a keyserver for the Verein :) In-Reply-To: <202009021738.08777.bernhard@intevation.de> References: <202008251220.22666.bernhard@intevation.de> <4462932.ga6r42dKOQ@esus> <202009021738.08777.bernhard@intevation.de> Message-ID: <4558769.GXAFRqVoOG@kymo.gruen> Hi Andre, Hi Fellow-Verein-Members, > Thanks a lot for your work! It is great that we have a "reference server" > now hosted by an independet entity. it is not ready yet, we need it as test server for improving hockeypuck. I just gave the DNS name here internally so Werner know where to point the new name. As Sascha writes: | It's currently down because we have not finished the configuration, yet. | Bernhard was a a little fast announcing it. | I will come back to you when it's ready. > I'm not a fan of the verein subdomain. It makes it longer and uglier, > especially for non-germans speakers. I think it is good to give some visibility to the "Verein" and that it is different from gnupg.org (which I'd call the Free Software initiative that creates GnuPG and Werner would call the "GnuPG Project".) And for most the doman name is just a name they enter once. > I still think "keys.gnupg.org" would be best. I don't really think that it > is confusable with "keys.openpgp.net". OpenPGP is something different then > GnuPG. > > And having it close to keys.gnupg.net would also be fine. The .org is the > Organisation (The Verein) the .net is the Keyserver Network. Very fitting. If you don't want to use keys.verein.gnupg.org, then please let us go with either pubkeys.gnupg.org or keyserver.gnupg.org because as you know I've seen a number of support cases and humans tend to overlook the ".org" ".net" difference, just like they tend to not notice small spelling Mistakes or upper-lower case differences. It is not signifcant enough. In the end, as the Verein is the principal of the keyserver, we'll go with whatever you decide, of course. :) Best Regards, Bernhard -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 659 bytes Desc: This is a digitally signed message part. URL: From aheinecke at gnupg.org Thu Sep 3 11:04:57 2020 From: aheinecke at gnupg.org (Andre Heinecke) Date: Thu, 03 Sep 2020 11:04:57 +0200 Subject: Running a keyserver for the Verein :) In-Reply-To: <4558769.GXAFRqVoOG@kymo.gruen> References: <202008251220.22666.bernhard@intevation.de> <202009021738.08777.bernhard@intevation.de> <4558769.GXAFRqVoOG@kymo.gruen> Message-ID: <15994292.7KsQMbkAKj@esus> Hi, On Wednesday 2 September 2020 20:04:00 CEST Bernhard Reiter wrote: > it is not ready yet, we need it as test server for improving hockeypuck. > I just gave the DNS name here internally > so Werner know where to point the new name. Ok. > If you don't want to use keys.verein.gnupg.org, > then please let us go with either > pubkeys.gnupg.org > or > keyserver.gnupg.org I don't have a super strong opinion here, So we can go with your suggested .verein. name. I just wanted to enter my opinion into the discussion and not veto your suggested name. > just like they tend to not notice small spelling Mistakes or upper-lower > case differences. It is not signifcant enough. I laughed out loud ;-) > In the end, as the Verein is the principal of the keyserver, we'll go with > whatever you decide, of course. :) I don't think that this must be the case, we are a community and can discuss such things, and we are open to other opinions. Best Regards, Andre -- GnuPG.com - a brand of g10 Code, the GnuPG experts. g10 Code GmbH, Erkrath/Germany, AG Wuppertal HRB14459 GF Werner Koch, USt-Id DE215605608, www.g10code.com. GnuPG e.V., Rochusstr. 44, D-40479 D?sseldorf. VR 11482 D?sseldorf Vorstand: W.Koch, B.Reiter, A.Heinecke Mail: board at gnupg.org Finanzamt D-Altstadt, St-Nr: 103/5923/1779. Tel: +49-211-28010702 From wk at gnupg.org Thu Sep 3 22:06:38 2020 From: wk at gnupg.org (Werner Koch) Date: Thu, 03 Sep 2020 22:06:38 +0200 Subject: Running a keyserver for the Verein :) In-Reply-To: <4558769.GXAFRqVoOG@kymo.gruen> (Bernhard Reiter's message of "Wed, 02 Sep 2020 20:04:00 +0200") References: <202008251220.22666.bernhard@intevation.de> <4462932.ga6r42dKOQ@esus> <202009021738.08777.bernhard@intevation.de> <4558769.GXAFRqVoOG@kymo.gruen> Message-ID: <87zh66wrox.fsf@wheatstone.g10code.de> On Wed, 2 Sep 2020 20:04, Bernhard Reiter said: > keyserver.gnupg.org That looks good to me. it should be really different from keys.gnupg.net because the latter is not uses as DNS entry but as an hardwired alias to the sks pool. Salam-Shalom, Werner -- Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 227 bytes Desc: not available URL: From bernhard at intevation.de Fri Sep 4 10:17:00 2020 From: bernhard at intevation.de (Bernhard Reiter) Date: Fri, 4 Sep 2020 10:17:00 +0200 Subject: Running a keyserver for the Verein :) In-Reply-To: <87zh66wrox.fsf@wheatstone.g10code.de> References: <202008251220.22666.bernhard@intevation.de> <4558769.GXAFRqVoOG@kymo.gruen> <87zh66wrox.fsf@wheatstone.g10code.de> Message-ID: <202009041017.01352.bernhard@intevation.de> Am Donnerstag 03 September 2020 22:06:38 schrieb Werner Koch: > On Wed, 2 Sep 2020 20:04, Bernhard Reiter said: > > keyserver.gnupg.org > > That looks good to me. Feel free to point the DNS to the server I've mentioned. (Again note: It is not fully operational yet, we want to add blacklisting first, so we'll be able to block spam and illegal contents before we go live. Also we'll use it as production/staging server for improved variants of hockepuck.) Best Regards, Bernhard -- www.intevation.de/~bernhard ? +49 541 33 508 3-3 Intevation GmbH, Osnabr?ck, DE; Amtsgericht Osnabr?ck, HRB 18998 Gesch?ftsf?hrer Frank Koormann, Bernhard Reiter, Dr. Jan-Oliver Wagner -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 659 bytes Desc: This is a digitally signed message part. URL: From bernhard at intevation.de Fri Sep 4 10:20:24 2020 From: bernhard at intevation.de (Bernhard Reiter) Date: Fri, 4 Sep 2020 10:20:24 +0200 Subject: Financially supporting hockepuck author (Re: Running a keyserver for the Verein :)) In-Reply-To: <3239680.4SLFfMIBU6@esus> References: <202008251220.22666.bernhard@intevation.de> <202009021738.08777.bernhard@intevation.de> <3239680.4SLFfMIBU6@esus> Message-ID: <202009041020.25075.bernhard@intevation.de> Am Mittwoch 02 September 2020 18:41:32 schrieb Andre Heinecke: > On Wednesday 2 September 2020 17:37:54 CEST Bernhard Reiter wrote: > > * github sponsor programm can be used to give some money to > > ? hockeypuck. (I've tried, but there are problems with them charging us.) > > ? The verein could do this. I suggest 10-50 USD/month I think it would > > help covering costs for the reference hockeypuck server. > > This is indeed interesting, I'm more for 100$ / month for the corporate > tier. Would be cool indeed. Note that if the verein wants to do 1200 USD a year we should think of transfering this to Casey directly and noting going via github. (Github only offered us paypal and credit card and the latter did not work. Using Github has the advantages: They sometimes seem to add to the donation amount from ther side. It maybe a public example. And the drawback that sponsoring Casey is for all of his projects and github may take a percentage at some point.) > Any opinions on this from others? I think its a good way to spend our > money. Best Regards, Bernhard -- www.intevation.de/~bernhard ? +49 541 33 508 3-3 Intevation GmbH, Osnabr?ck, DE; Amtsgericht Osnabr?ck, HRB 18998 Gesch?ftsf?hrer Frank Koormann, Bernhard Reiter, Dr. Jan-Oliver Wagner -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 659 bytes Desc: This is a digitally signed message part. URL: