How much load are keyservers willing to handle?

Thu Dec 19 04:42:31 CET 2013

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Jason Harris:
> On Wed, Dec 18, 2013 at 10:20:26PM +0000, adrelanos wrote:
> 
>> I am planing to write a script, which will refresh the apt
>> signing key before updating using "apt-get update". The script
>> might get accepted in Debian. [1] With my Whonix hat on, it's
>> safe to say, that this script will be added to Whonix (which is a
>> derivative of Debian).
>> 
>> Writing that script would be much simpler if it could re-use the 
>> existing keyserver infrastructure. Now imagine if this gets added
>> to Debian, that all users of Debian and all its derivatives will
>> always refresh their signing key against keyservers? Could
>> keyservers cope up with the load?
>> 
>> The legal question would be interesting, but don't worry, if you
>> ask me not to use keyservers for this, I'll use a mechanism
>> outside of keyservers.
> 
>> [1]
>> http://lists.debian.org/debian-security/2013/12/msg00031.html
> 
> 1) setup your own DNS so you can shut things off if anything goes
> wrong! (you can use dyn.com or others, no servers required)

Interesting idea. I guess in that case I'll got with what I wrote
under 3).

> 2) probably best discussed on the sks-devel list, Reply-To set
> accordingly

Okay, I'll repost there.

> 3) try running your own keyserver(s), SKS is easy enough to deploy

I don't have a lot servers with bandwidth available. And rather than
spending money on that, in case keyservers decline, I am probably
re-using sourceforge.net's infrastructure. I already asked them once
about a similar thing [they're willing to host our project news files
(comparable small files with comparable load)], they'll most likely
accept that as well. I don't know how they or some others manage it,
but their traffic comes virtually for free.