3 ms·

What do you find inadequate about PGP key-servers?

• __david__ 10y ago
  So you pull the package down and the signature checks out to some key on a pgp key server. How do you know it's the correct key?
  • falcolas 10y ago
    Generally, the key already exists on your system, as it's coming through the official channels. If you decide to add the cert manually, you can inspect the key and see who has signed it, and decide your level of trust. With HTTPS, you only ever have the choice of trusting the 1000+ CAs in your keyring.
    • oconnore 10y ago
      > If you decide to add the cert manually, you can inspect the key and see who has signed it, and decide your level of trust. No one has signed it, because the mythical web of trust does not exist. What now?
      • falcolas 10y ago
        Contact the developer (say, over IRC, Slack, email, GitHub, etc), and ask them to sign a sentence you provide with it. Then you can sign their key.
• oconnore 10y ago
  Where is the web of trust that lets me cryptographically verify that my install.sh file was published by some PhD student in the Netherlands? And unless I trust the https server, how do I know which PhD student in the Netherlands I'm supposed to trust? If this were software that I had to install multiple times (say there are several updates a year), it might make sense to implement TOFU with a published GPG key -- each successive update would use the same key I imported the first time. However, the nix installer installs a package manager which is self updating, and therefore implements TOFU itself.