Re: sks.infcs.de take down // Re: keyserver.insect.com GDRP takedown request

[Andrew Gallagher]

> On 28 May 2022, at 16:08, Steffen Kaiser  wrote:
> 
> I didn't followed the thread right now, but if somebody has a hacked
> hockeypuck server (I do not know go at all), which does not download
> blacklisted keys, please send a link

Install hockeypuck 2.1.0 or later and follow Alexandre’s instructions from 
earlier in the thread. Blacklisting is now a feature. :-)

A

Re: keyserver.insect.com GDRP takedown request

[Steffen Kaiser]

On 27.05.22 12:03, Ced wrote:
> On Fri, 27 May 2022 10:47:02 +0200 (CEST)
> "Kiss Gabor (Bitman)"  wrote:
> 
>> IMHO Mr. Puerto must show some evidence first about the key to delete
>> belongs to him. Otherwise any impostor can make delete other guys'
>> key.
> 
> I thought the same thing and asked him (privately) to resend his request
> in a PGP-signed email, which he did, so this is legit.
> 

I did so, too. He responded to the mail address, which is "legit" enough
for me and for everybody who can order me around at this topic.

-- 
Steffen



signature.asc
Description: OpenPGP digital signature

sks.infcs.de take down // Re: keyserver.insect.com GDRP takedown request

[Steffen Kaiser]

On 26.05.22 22:53, Jason John Schwarz via SKS development and deployment
list wrote:

Hi everybody,

> We have received the same take down request from Mr. Puerto as several other 
> keyservers under GDRP.
> As we are running keyserver.insect.com as a free service we can not afford to 
> deal with legal costs on this
> request, and therefore are shutting down keyserver.insect.com effective today.

I git the removable request as well. Therefore I stopped my SKS servers
and removed the mentioned keys. The servers stay out of the pool or will
be deleted in some weeks, if I cannot handle the issue by removing the
keys and keep them out of my server space. No matter if/what/how a legal
case would end.

I didn't followed the thread right now, but if somebody has a hacked
hockeypuck server (I do not know go at all), which does not download
blacklisted keys, please send a link. Otherwise it will take some time
to read through.

If there is no solution for keeping blacklisted keys out of the server
space, I will not bring any server back into the pool.

The main problem on my site is, that most people use Thunderbird
nowadays and switched to https://keys.openpgp.org/about/usage . This
does not make me happy, because we have some scenarios, in which we do
not want to make external connections each time and/or use a local key
server for local only keys, which are merged with the pool locally.

Kind regards,

-- 
Steffen




signature.asc
Description: OpenPGP digital signature