| Author |
Message |
| is syndie-on-tor a fake? |
|
 Posted:
Sat Mar 01, 2008 9:33 pm
|
|
|
|
|
is syndie-on-tor a fake?
Hi, today is on tor a new syndie-source site but it got different GPG public keys
can anyone proof this and bring some light on it?!
syndie-on-tor GPG public keys:
sign the distributed files is 395C4CED (fingerprint 278A 514C EFDA AE9D B864 C44B 67A4 8338 395C 4CED)
syndie.i2p2.de GPG public keys:
sign the distributed files is 393F2DF9 (fingerprint AE89 D080 0E85 72F0 B777 B2ED C2FA 68C0 393F 2DF9)
http://xflemvwlo7dld6dk.onion/
see also:
http://entropy-proxy.i2p/KSK@syndie-on-tor.gif |
|
|
|
|
|
| Posted:
Sun Mar 02, 2008 7:47 am
|
|
|
Joined: 14 Feb 2008
Posts: 6
|
|
393F2DF9 is jrandom's public key, with which he signed all his releases. 395C4CED is mine, with which I signed my most recent release. (I posted my GPG public key in Syndie when I announced that release.) The most likely conclusion is that http://xflemvwlo7dld6dk.onion/ is distributing my release, while syndie.i2p2.de is distributing one of jrandom's.
That's why the keys are different, but it doesn't really help, does it? What you're really asking is which of these releases you can trust, and I can't answer that for you. |
|
|
|
|
|
| Posted:
Sun Mar 02, 2008 10:59 pm
|
|
|
|
|
| MOSFET wrote: |
That's why the keys are different, but it doesn't really help, does it? What you're really asking is which of these releases you can trust, and I can't answer that for you. |
it's not really a kindof trusting or unbelieving. it was just a thought of paranoia and to spread the information about a other download page. (so the developer could take care of this - if it's a trap-)
all i do here in i2p i still do also in the www . so i've no solid considerations to use i2p.
time will face the truth.
i'm not so long on i2p and didn't know anything what goes on or happens with the primary developer or why i2p **switches to i2p2. just read some threads about some miscellaneous curiositys about that.
at the moment i just testing i2p (like a lot of other software that supports anonimity) as ordinary user but in time i may take a look on the source too.
thanks that you bring a bit more brightness in the darkness of my knowledge about i2p.
** maybe somebody could paste a link to the thread that explain me what happens (i didn't find anything yet. thanks |
|
|
|
|
|
| Posted:
Mon Mar 03, 2008 2:44 pm
|
|
|
I2Pharaoh
Joined: 25 Feb 2005
Posts: 1148
|
|
Hi!
It would be far easier to trust the source if its in mtn and we can check the changes easily.
Right now we need to get the whole source and diffon our own.
amiga |
|
|
|
|
|
| Posted:
Wed Mar 26, 2008 5:22 pm
|
|
|
Joined: 14 Feb 2008
Posts: 6
|
|
I don't feel comfortable using mtn. I get nervous when I have to generate a unique keypair just to pull some data down, it leaves me wondering just what is going on behind the scenes and in what ways I might be unwittingly compromising myself.
In any case, I include a complete diff with my announcement messages in Syndie, so if you keep a copy of the latest sources on hand there's no need to download the source tarball at all. I'll consider auditing mtn so I can trust it if someone can make a compelling case demonstrating how it is better than what I do now. |
|
|
|
|
|
