4 ms·
What's the threat model you are defending against here? GitHub changing the binary being downloaded? They could serve a different signature. Another committer
by richardwhiuk 11y ago
What's the threat model you are defending against here?
GitHub changing the binary being downloaded? They could serve a different signature.
Another committer changing the tag? They could equally change the signature....
- lmm 11y ago> GitHub changing the binary being downloaded? They could serve a different signature. > Another committer changing the tag? They could equally change the signature.... No they couldn't, not unless they have your private key. (Debian does actually require all keys used to sign debian packages to have a trust path back to them - if you want to become Debian maintainer for a project you have to meet up with a Debian developer and have them sign your GPG key - so GitHub or another committer couldn't just use a different key to sign with).
- edwintorok 11y agoGithub doesn't have your private key, so they won't be able to serve a valid signature. The only thing they could do is to substitute an older signed version when you request a newer version.
- ashitlerferad 11y agoThey could create a new private key using your name. Most people will trust 'Verified' on a web page more than the OpenPGP web of trust.
- sneak 11y agoNot sure why you're being downvoted, this "what is the threat model here" was my first thought, too, and this comment is also correct, as well.
- ashitlerferad 11y agoProbably my "Most people" quip.
- zokier 11y agoThe xkcd trust model https://xkcd.com/1181/ https://xkcd.com/1181/
- ashitlerferad 11y agoTo emphasise this, there is an evil duplicate of the OpenPGP "strong set" here: https://evil32.com/ https://evil32.com/
- makomk 11y agoMost people will, but this is written by a Debian developer and they're one of the few groups of people who actually make use of the OpenPGP web of trust.