PGP verifying NoCeM messages

PGP verifying NoCeM messages

[Lance A. Brown]

Does anyone actually check the PGP signatures on NoCeM messages?  I've
checking them since Gnus5 started supporting it but am about ready to
turn it off because of the long delay in incurs.

--[Lance]

Re: PGP verifying NoCeM messages

[Lars Magne Ingebrigtsen]

"Lance A. Brown" <labrown@splat.niehs.nih.gov> writes:

> Does anyone actually check the PGP signatures on NoCeM messages?  I've
> checking them since Gnus5 started supporting it but am about ready to
> turn it off because of the long delay in incurs.

After fetching the keys once, the PGP verification itself seems to be
pretty quick.  The problem I had in this area was that all the PGP
key servers I tried were so slow in answering that Mailcrypt would
time out and give up.  And then, on the next NoCeM article, it would
try to fetch the key anew.  And time out.  And...

-- 
(domestic pets only, the antidote for overdose, milk.)
  larsi@ifi.uio.no * Lars Ingebrigtsen

Re: PGP verifying NoCeM messages

[Mark Eichin]

> key servers I tried were so slow in answering that Mailcrypt would

look for improvement in that area soon.  Marc Horowitz rewrote the
keyserver as an MIT thesis project... and got as much as 100x speed up
in some parts... 

There's a beta of the new keyserver code out there, I don't know when
it'll actually be released (or running on the "standard" servers.)

Re: PGP verifying NoCeM messages

[David Moore]

> > key servers I tried were so slow in answering that Mailcrypt would

	I ended up turning of the pgp verifying, but couldn't you put
their keys in your local ring and solve the key server problems?


-- 
David Moore <dmoore@ucsd.edu>       | Computer Systems Lab      __o
UCSD Dept. Computer Science - 0114  | Work: (619) 534-8604    _ \<,_
La Jolla, CA 92093-0114             | Fax:  (619) 534-1445   (_)/ (_)
<URL:http://oj.egbt.org/dmoore/>    | In cloud bones of steel.

Re: PGP verifying NoCeM messages

[Lance A. Brown]

Lars Magne Ingebrigtsen  writes:

> After fetching the keys once, the PGP verification itself seems to be
> pretty quick.  The problem I had in this area was that all the PGP
> key servers I tried were so slow in answering that Mailcrypt would
> time out and give up.  And then, on the next NoCeM article, it would
> try to fetch the key anew.  And time out.  And...

I noticed that too initially.  One NoCeM'ers key was not on the key
server I was using so things were taking forever whenever one of his
articles came through.

My concern now is that there are a LOT of NoCeM messages waiting to be
processed in the morning and it often take 5+ minutes for all the PGP
verification to occur.  This is on an R4000 100Mhz SGI Indy.  Is there
a significant risk of NoCeM spoofing?

--[Lance]

Re: PGP verifying NoCeM messages

[Alan Shutko]

>>>>> "DM" == David Moore <dmoore@UCSD.EDU> writes:

>> > key servers I tried were so slow in answering that Mailcrypt
>> would
DM> 	I ended up turning of the pgp verifying, but couldn't you put
DM> their keys in your local ring and solve the key server problems?

Not if you can't get said keys in the first place.  I didn't realize
that these keys were there and just slow... I suppose I should go
look.

-- 
Alan Shutko <ats@hubert.wustl.edu> - The Few, the Proud, the Remaining.
You have an unusual understanding of the problems of human relationships.

Re: PGP verifying NoCeM messages

[Paul Stodghill]

>>>>> "David" == David Moore <dmoore@UCSD.EDU> writes:

    David> 	I ended up turning of the pgp verifying, but couldn't you
    David> put their keys in your local ring and solve the key server
    David> problems?

Yes, this is exactly what I have done. Works just fine: NoCeM verification
is acceptable fast and doesn't fail.

-- 
Paul Stodghill <stodghil@cs.cornell.edu>
http://www.cs.cornell.edu/home/stodghil/home.html

Re: PGP verifying NoCeM messages

[Paul Stodghill]

>>>>> "Lance" == Lance A Brown <labrown@splat.niehs.nih.gov> writes:
    Lance> My concern now is that there are a LOT of NoCeM messages waiting
    Lance> to be processed in the morning and it often take 5+ minutes for
    Lance> all the PGP verification to occur. This is on an R4000 100Mhz
    Lance> SGI Indy. Is there a significant risk of NoCeM spoofing?

If you can leave yourself logged in overnight, I _strongly_ recommend using
the demon for doing stuff like this when your Emacs is idle.

Here's what I have in my .gnus:

	(gnus-demon-add-nocem)

	;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
	;; Redefine some functions from gnus-demon.el

	;; 1 min idle time isn't enough. Wait for 5 mins.
	(defun gnus-demon-add-nocem ()
	  "Add daemonic NoCeM handling to Gnus."
	  (gnus-demon-add-handler 'gnus-demon-scan-nocem 60 5))

	;; Don't try to fetch pgp keys when verifying in the demon.
	;; Emacs is idle! There's noone to answer Mailcrypt's prompts!
	(defun gnus-demon-scan-nocem ()
	  "Scan NoCeM groups for NoCeM messages."
	  (save-window-excursion
	    (let ((mc-pgp-always-fetch 'never))
	      (gnus-nocem-scan-groups))))

-- 
Paul Stodghill <stodghil@cs.cornell.edu>
http://www.cs.cornell.edu/home/stodghil/home.html

Re: PGP verifying NoCeM messages

[Lance A. Brown]

Paul Stodghill <stodghil@CS.Cornell.EDU> writes:

> If you can leave yourself logged in overnight, I _strongly_ recommend using
> the demon for doing stuff like this when your Emacs is idle.

I've been trying the demon stuff out as well, but stopped when I
realized the demon was kicking in while I was working with emacs!
[pause]  Hmm.  I see a demon fix in the changelog so I'll have to try
this stuff out again.

What I'd really like is to run an emacs process with gnus-slave in the
background and have it do all the NoCeM stuff and have my normal emacs
pull the slave info in whenever I read news.  Then I could just leave
the backgrounded emacs running all the time with gnus-demon processing
the NoCeM for me.

> Here's what I have in my .gnus:

> 	(gnus-demon-add-nocem)

> 	;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
> 	;; Redefine some functions from gnus-demon.el

> 	;; 1 min idle time isn't enough. Wait for 5 mins.
> 	(defun gnus-demon-add-nocem ()
> 	  "Add daemonic NoCeM handling to Gnus."
> 	  (gnus-demon-add-handler 'gnus-demon-scan-nocem 60 5))

> 	;; Don't try to fetch pgp keys when verifying in the demon.
> 	;; Emacs is idle! There's noone to answer Mailcrypt's prompts!
> 	(defun gnus-demon-scan-nocem ()
> 	  "Scan NoCeM groups for NoCeM messages."
> 	  (save-window-excursion
> 	    (let ((mc-pgp-always-fetch 'never))
> 	      (gnus-nocem-scan-groups))))

> -- 
> Paul Stodghill <stodghil@cs.cornell.edu>
> http://www.cs.cornell.edu/home/stodghil/home.html

Re: PGP verifying NoCeM messages

[Lars Magne Ingebrigtsen]

"Lance A. Brown" <labrown@splat.niehs.nih.gov> writes:

> What I'd really like is to run an emacs process with gnus-slave in the
> background and have it do all the NoCeM stuff and have my normal emacs
> pull the slave info in whenever I read news. 

That should be possible...  The NoCeM files are written independently,
but you have to use some method for forcing Gnus to read the
(processed) NoCeM files.

Uhm, you should be able to just execute the `gnus-nocem-load-cache'
function in the master Gnus...  I've now made it an interactive
command. 

-- 
(domestic pets only, the antidote for overdose, milk.)
  larsi@ifi.uio.no * Lars Ingebrigtsen