Re: Announcing Fedora GPG Key Server - keys.fedoraproject.org

[Björn Persson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Nick Bebout wrote:
> The Fedora Infrastructure team is pleased to announce that
> keys.fedoraproject.org is now up and running as a GPG keyserver.

[...]
> Web interface at http://keys.fedoraproject.org or
> https://keys.fedoraproject.org

If it's supposed to be accessible with both encrypted and unencrypted
HTTP, then I think the lookup form should support both ways, like the
add form does. Currently the lookup form is hardcoded to be submitted
unencrypted, so all the spies can see who looks up which keys.

This query exposes a character encoding bug in the page title:
https://keys.fedoraproject.org/pks/lookup?search=Rombobj%C3%B6rn&op=vind...

Björn Persson
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.19 (GNU/Linux)
>
> iQIcBAEBCgAGBQJSJcS6AAoJEOE4WtzWSuY/1EIQALW3I/QSWHAka1lxdz1+Sw5u
> 4OTaVjXJWQ+vJbbEfSf1JMBxHXTYVIBRLANA6UmSKRsmFtrcuVh/qjgld4CKkkCI
> ib2DurIHM6lLYXcXgDtEEC+/YehuIRp2S1QkZ75oRJrY/ohiBh/+Vl8AEVBYAVmP
> BuMzgNeRIhE3TvBq6yzlB16W6St+HlEgdLtNt/f658DZciau4HM2Jvgt3R4HOZJ2
> fDmclOPH77XFQqYlxYXsefqRbgO5w1ISTji3SGoAO1Q/9kBf1Fp/41Q/HByKthLM
> 15yNQd094n2iy9+0GWl4eTOfeify88RkVcE0V0c5MzAYeBQy2S9c9aiT991RLURp
> +il7kh/MBVmc9nrLrKW7Y8tTWDAS/xgfyCjWFoWCKGozXDTuOcPg3hrrLkjPeZFQ
> +Xus6EMjFdCV5/WNpC6H6WbKhXv6AfM21AA0D9UGubGMpsGCKLv+PpmSkACI4jLm
> Azr0Ih7gCIrOtJlXLHxUGye/L8492p7PXLYkmb3feUzkSSarc52lhYDpERp1j2GB
> +co4vTqJxclT1cbmo8r1SuZUqwOH15GkJgFJhSXV/XMe7uVAyr1geqDrRWSund4I
> OiYFWaiPJKpmkM3MhALXb6qgrVng4EH9ZbhCqvEE+L1hqgpbNxC9I27l0ngATZ/z
> 0b48pmXH79nIeX1yBjTE
> =qbka
> -----END PGP SIGNATURE-----

Announcing Fedora GPG Key Server - keys.fedoraproject.org

[Kevin Fenzi]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On Tue, 3 Sep 2013 13:15:05 +0200
Björn Persson  wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> Nick Bebout wrote:
> > The Fedora Infrastructure team is pleased to announce that
> > keys.fedoraproject.org is now up and running as a GPG keyserver.
>
> [...]
> > Web interface at http://keys.fedoraproject.org or
> > https://keys.fedoraproject.org
>
> If it's supposed to be accessible with both encrypted and unencrypted
> HTTP, then I think the lookup form should support both ways, like the
> add form does. Currently the lookup form is hardcoded to be submitted
> unencrypted, so all the spies can see who looks up which keys.
>
> This query exposes a character encoding bug in the page title:
> https://keys.fedoraproject.org/pks/lookup?search=Rombobj%C3%B6rn&op=vind...

Could you file a ticket in the Fedora infrastructure trac and we can
get this fixed up?

Thanks.

kevin
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.21 (GNU/Linux)
>
> iQIcBAEBCgAGBQJSJhR8AAoJEEs3sNgP+7teWZYP/A6IeZPOZxlc+XZOQ2ldGGvg
> S90uN7fA3T1voOpgvxS7JeUVvyQkVJjDLnAmVfedArZiE6qniNteybS3BTWnZSLB
> R3EMTgPxXbuRa5lAj4IbC1OOCEkeXnzdVU4hryoNA1DmiQ77mOfRlTKVe9MiPmY7
> JEPTTdQspCewHQ8cMAID/gtKeYAb2aVIeQUQ1EtRpKZny0H1K5n0mmwBCWBbf3Hg
> PRnZYyCpY8ukTKV/R6ulYv8J7aAyu5IpgZ++DaG8B6gT1LA32HrQkAvbdAPrLTLX
> BRQuae5jO3Grw+5hMp6WChvQUaZL7DVatLRw6QiEtazGyXsHdhQGY47s0olGZXzo
> kPKKtLlKuGsnrPoRa+1hTcjqde178GiiRmvdFIg9xY8UwE25GiEcsjUHFw5IEBWW
> 6GW+xvvDdLbY13BOMcSUd/WswnpHTCHjZSF2eoIlNBLKdpPlzH2Knlc1yHL1Yfgb
> oYlW4GVzcuvSa0IlDSHU5raqYfTOCTBsVWeUj0RiunJYd04VzVpOSAqyEp+zHTIg
> c9jJsxetN6NHYw2DRte5Tw1GI7pITS4fuHDUVrTPaOx8bIEVcGAW7HrDYcWzu0tz
> G6u1xHDTOZuzBFCjb+WCQy7LK2/pjpCD/ocH1lER/BSegiv4UrmnxBWP/kBRyytE
> Zdixc340bxC1WZvCm28k
> =/Vx1
> -----END PGP SIGNATURE-----

Announcing Fedora GPG Key Server - keys.fedoraproject.org

[Björn Persson]

Kevin Fenzi wrote:
> Björn Persson  wrote:
> > Nick Bebout wrote:
> > > The Fedora Infrastructure team is pleased to announce that
> > > keys.fedoraproject.org is now up and running as a GPG keyserver.
> >
> > [...]
> > > Web interface at http://keys.fedoraproject.org or
> > > https://keys.fedoraproject.org
> >
> > If it's supposed to be accessible with both encrypted and
> > unencrypted HTTP, then I think the lookup form should support both
> > ways, like the add form does. Currently the lookup form is
> > hardcoded to be submitted unencrypted, so all the spies can see who
> > looks up which keys.
> >
> > This query exposes a character encoding bug in the page title:
> > https://keys.fedoraproject.org/pks/lookup?search=Rombobj%C3%B6rn&op=vind...
>
> Could you file a ticket in the Fedora infrastructure trac and we can
> get this fixed up?

Two tickets filed.

Björn Persson