https://bugzilla.novell.com/show_bug.cgi?id=457802
https://bugzilla.novell.com/show_bug.cgi?id=457802#c8
--- Comment #8 from Christian Boltz
First, the performance gap is tremendous: With GPG signing: [info 30110 14:51:55] Sent due messages: 2 in 0.473319 sec. Without signing : [info 30128 14:52:39] Sent due messages: 2 in 0.077101 sec.
Indeed, that's a serious difference (but not too surprising, given the computing work GPG has to do). I wonder if this is a problem in practise - how busy is the server currently?
Furthermore, the keys would have to be on the server which is considered a security problem here.
Yes, the keys obviously have to be on the server to sign the mails. That's not too different to the keys used to sign the packages and repos in OBS. OTOH, it would still be much more secure than the current unsigned mails... (In theory you could setup a separate server that is used as signing gateway (using a content_filter or something like that) - but it will probably just sign everything it gets from hermes, so the security win would be limited.) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.