On Sun, Jan 10, 2016 at 03:56:59PM -0500, charles profitt wrote: I like this idea. Perhaps it would also make sense in the initial article to include infromation about a few GUI applications that people can use to manage GPG keys, e.g. Seahorse. -- Paul W. Frields http://paul.frields.org/ gpg fingerprint: 3DA6 A0AC 6D58 FEC4 0233 5906 ACDB C937 BD11 3717 http://redhat.com/ - - - - http://pfrields.fedorapeople.org/ The open source story continues to grow: http://opensource.com

Kleopatra? Isn't it forfor that? I'm really interested to read this article as I know GPG only on the surface. Cheers, Sylvia On Monday, 11 January 2016, charles profitt <fedora(a)cprofitt.com&gt; wrote:

Hi, as a disclaimer: I am not so much experienced with marketing, but I have some generic/technical ideas. On Sun, Jan 10, 2016 at 03:56:59PM -0500, charles profitt wrote: Not sure, if you plan to address this, but here are some questions that I would try to answer in such a posting: * Why should I use GPG/why do I need it? * Despite protecting E-Mail and Jabber communication this should also mention protection of software. For example package maintainer should use it to verify the source code coming from upstream: http://pkgs.fedoraproject.org/cgit/rpms/youtube-dl.git/tree/youtube-dl.sp... * How does Fedora use it? * IMHO one important fact about Fedora is that we protect nearly all deliverables with GPG, i.e. ISO images, VM images and RPMS. Only Fedora Rawhide is not always completely signed. See for example: https://getfedora.org/verify * Also FAS allows to store a GPG fingerprint to be able to recover an account in case of lost e-mail access and password. It currently say GPG key id, but it will be the fingerprint with the next release. * And GPG keys from FAS accounts are available via DNSSEC using the openpgpkey tool (in package hash-slinger) * maybe more? * How do I manage GPG keys in RPM/DNF? * This would be something specific to Fedora that is not found in other guides. Then there are important technical aspects, that one should consider: * https://help.riseup.net/en/security/message-security/openpgp/best-practices * https://evil32.com/ And other topics could be using smartcards/tokens to protect the key or using GPG keys for SSH authentication. Kind regards Till

On 01/10/2016 03:56 PM, charles profitt wrote: Big hearty +1 to the idea from me. I think this would be a good, comprehensive series that could help break a very complicated subject into smaller, more easily digestible pieces. This is something that would be great to try to scout out new authors who are familiar with the topics to contribute to! -- Cheers, Justin W. Flory jflory7(a)gmail.com