Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:113919
MIME-Version: 1.0
References: <CAF+90c9A6zG-nYzc3NNtWGjN7y5FmwqnYzjq6GSFC5NtRsOT0w@mail.gmail.com>
 <CAN2symg2SueEONzMRndsWEhj6anXmeAQwKg+HzKh-o61bcP0Qg@mail.gmail.com>
 <CAESVnVoPEitSCzmrAR2pRY4zUp4WEBc3a1b3q4H_uh1q8ebVWw@mail.gmail.com>
 <CAEYWF=71sahVwiaPEAYMCfLd+fgZ5FA24bS-LCtzxNW==9H=xg@mail.gmail.com>
 <c0849f5f-4233-d0f1-d00d-29840459070b@gmail.com> <CAEYWF=5PE9MKt_zxU8u+Mv0oHz_Stw3_vVNe1BWfO-5mZ7ab5g@mail.gmail.com>
 <CAESVnVoeXy0NkbD+g4GOp-n2gUQ3G-rkfW-oaTAy4khUgMSUdw@mail.gmail.com>
 <a874febc-af61-cb2d-c16c-3f78daae25c1@gmail.com> <CAESVnVoS68LuXbVMHLm=KrJdJJ2va-WMRxLWWXUW-GrS5joVOg@mail.gmail.com>
In-Reply-To: <CAESVnVoS68LuXbVMHLm=KrJdJJ2va-WMRxLWWXUW-GrS5joVOg@mail.gmail.com>
Reply-To: bishop@php.net
Date: Thu, 1 Apr 2021 13:04:49 -0400
Message-ID: <CAEYWF=41tw+TvNswD8nWhZcYFsbVaXhYPF8+GgQj2BOefBAHjQ@mail.gmail.com>
To: Sara Golemon <pollita@php.net>
Cc: Rowan Tommins <rowan.collins@gmail.com>, PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000ceeb4605beec3cee"
Subject: Re: [PHP-DEV] Changes to Git commit workflow
From: bishop@php.net (Bishop Bettini)

--000000000000ceeb4605beec3cee
Content-Type: text/plain; charset="UTF-8"

On Thu, Apr 1, 2021 at 12:24 PM Sara Golemon <pollita@php.net> wrote:

> On Thu, Apr 1, 2021 at 11:19 AM Rowan Tommins <rowan.collins@gmail.com>
> wrote:
>
> > On 01/04/2021 15:59, Sara Golemon wrote:
> > > On Thu, Apr 1, 2021 at 9:21 AM Bishop Bettini <bishop@php.net
> > > <mailto:bishop@php.net>> wrote:
> > >
> > >     I also added a FAQ.
> > >
> > >
> > > I disagree with the position this document takes on immortal keys.  We
> > > should encourage best-practices with the knowledge that some people
> > > will weaken their security with an immortal key, not start from a weak
> > > position and suggest that adhering to best practices is "paranoid".
> >
> >
> > I've been looking around, and most of what I can find says that expiring
> > a primary key which you use directly for signing has very little value,
> > because anyone who has the private key and passphrase can change the
> > expiry date at any time.  See for example:
> > https://security.stackexchange.com/q/14718/51961
> >
> > The main use case seems to be when using sub-keys, where the primary key
> > (with no expiry) is kept offline, and new sub-keys are generated from it
> > regularly (e.g. once a year) with an appropriate expiry date.
> >
> > This is based only on a few hours of searching online, however, so I'd
> > be happy to see a better explanation of how to use expiry effectively.
> >
> >
> Yeah, I just got told the same offline.  That's.... depressing.  Not
> surprising when one thinks about it more, but still depressing.
>

Appreciate the feedback, Sara and Rowan!

I think there was still opportunity to improve that section, so I adjusted
the language to be less accusatory and highlight the essential limitations.

--000000000000ceeb4605beec3cee--