SKS Keyserver Network Under Attack

Re:SKS Keyserver Network Under Attack by koolba on Saturday June 29, 2019 @11:35AM (#20313146)

Yes this seems like it's going to range from very bad to outright terrible. In particular if the issue propagates prior to patching something like gpg as the package managers would be locked out from updates.

Every time there's an article about IoT security there's a discussion about lack of (security) updates and an upcoming Armageddon. Interestingly it'll be those devices that do not update that are immune to this type of thing.

[ Parent | on HN ]

Re:SKS Keyserver Network Under Attack by cyphar on Saturday June 29, 2019 @12:31PM (#20313433)

Package managers don't use keyservers to get their keys (at least, not for the distro's repos). I believe Ubuntu might use them for PPAs, but openSUSE doesn't use them for any OBS projects (and I'm pretty sure this is the same for any RPM repo).

[ Parent | on HN ]

Re:SKS Keyserver Network Under Attack by heavenlyblue on Saturday June 29, 2019 @02:22PM (#20313980)

>> immune to this type of thing.

The _only_ type of thing that they are immune to. This is like saying “a car with a broken engine is the safest car in the world - it never moves!”.

[ Parent | on HN ]

Re:SKS Keyserver Network Under Attack by majewsky on Saturday June 29, 2019 @02:27PM (#20314002)

I think the standard analogy for this sort of thing is "a broken clock shows the right time twice a day".

[ Parent | on HN ]