4 ms·
It was never a very secure OS / product / distro if a single individual was able to destroy the signing keys in this fashion. If this personal battle is enough
by numbsafari 8y ago
It was never a very secure OS / product / distro if a single individual was able to destroy the signing keys in this fashion.
If this personal battle is enough for folks to say the whole thing is now compromised, and one person held all the keys, how do you know he hadn’t been compromised before? If the code has no third party audits, or a web of trust, then it was never secure to begin with.
- TheAceOfHearts 8y agoThere's always a chain of trust. What alternative would you suggest? I think I remember reading that in Google there's like 5 people that have the master keys and are able to deploy any kind of change at any moment without any review or oversight. They're the top of the chain of trust.
- twblalock 8y agoThere is a big difference between a chain of trust with multiple people involved and corporate oversight, and a chain of trust that consists of one person who wields absolute power. So yeah, there is always a chain of trust, but some are better than others. In the Google case, if one of those 5 people started doing bad things, the others would presumably be able to stop him and undo the damage.