use-tor should not imply allow-version-check

[Werner Koch]

On Tue,  3 Jan 2017 23:27, steven at stebalien.com said:

> Given that `use-tor` is off by default (most users don't even have tor
> installed), you can't say GnuPG updates the software version database by

Well, okay.

> default. It does so iff `use-tor' or `allow-version-check' are enabled.
> Given that the user has to explicitly enable `use-tor', I see no
> advantage to automatically enabling `allow-version-check' with tor

Privacy aware people will use Tor and thus they should enable --use-tor.
I assume that Tails will enable this by default ;-)

> enabled. Anyways, I'd be very surprised if there are *any* users with
> `use-tor` enabled that don't update gnupg through a package manager.

Actually the Tor support works on Linux only since 2.1.17 unless a non
standard ADNS version was used.  On Windows however, Tor support is
available for a long time and thus we can assume that there are users
who enabled this.  And on Windows we don't have distributions except for
Gpg4win which now uses the version check.

I fully agree that for a Linux distro this is not required.  But see
below.

> Also, does gnupg even use this information? As far as I can tell, this
> feature isn't used internally so can't this information be fetched (and
> cached) when requested (when something calls `gpgconf --query-swdb')?

The idea behind the the SWDB is to provide the latest information of all
packages we provide - for example for users who build on their own.
Thus it can also be used to build software which depends on GnuPG or
GnuPG supported libraries.

Right now the Speedo build system of GnuPG uses the SWDB but only via a
simple script and with no easy way to route this via Tor.  This means
that the admins of versions.gnupg.org (e.g. me and my co-admins) as well
as any snooping TLA could learn the IP addresses of users who build
GnuPG on their own.  Now, as soon as this feature is widely deployed we
can update the Speedo build system to use gpgconf --query-swdb and
things would be easier.  This is why I like to have this service
available as widely as possible.

> Finally, gnupg is now the *only* software on my system that doesn't
> allow me to disable automatic update checks and the only daemon that
> even supports automatic update checks.

GnuPG is not xscreensaver and does not do any update checks on its own.
It only provides a service for other software to implement such a
service.

However, if more folks express a dislike for the
auto-update-swdb-via-tor feature, I am willing to revert this.


Now for the other topic:

>     <kernel> /usr/bin/dirmngr
>     network inet dgram send 217.69.76.56 443

Okay, so it is indeed dirmngr.
>
> dirmngr.conf:
>
>     use-tor
>     keyserver hkp://jirk5u4osbsr34t5.onion


I do not understand what is going on here.  Can we take this offlist to
figure out what is going on on your box?


Salam-Shalom,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 227 bytes
Desc: not available
URL: </pipermail/attachments/20170104/91fd7814/attachment.sig>