Re: anoncvs ssh keys?

[Josh Jore <josh@greentechnologist.org>]

Chris Humphries writes:
>Christian Weisgerber writes:
> > Josh Jore <josh@greentechnologist.org> wrote:
> > > I was wondering - is there any place where the OpenBSD cvs servers'
> > > ssh keys are kept?
> > No.
> > And if you worry about this, I suggest you first worry about those
> > servers authenticating their respective upstream servers.
> we're just supposed to trust. that is all you can do.

That's too bad. While I'm forced to trust that the various servers are
maintained correctly it's a pain having to take that initial fingerprint
for granted. As I was agreeing to use that key I was also mindful of
whatever that trojan thing was earlier this month. While (again) I'd have
to trust the ssh keys wherever they were kept it would (I trust, again) be
more difficult for someone hostile to get that other server as well.

Oh well. I just thought that perhaps it was already out there and I just
didn't notice it. (except for just doing a scan-ssh and keeping the
fingerprints myself)

Joshua b. Jore -{ weird geeky madness }-> http://www.greentechnologist.org