4 ms·

Suggest a way.

• tokyodude 8y ago
  A browser does this with every page you visit so there's clearly a path between what we have and what could be.
• ForHackernews 8y ago
  In apt, you can specify trusted keys for repositories and the packages downloaded are verified. Most Debian-based systems ship with standard repositories, but it's easy to add others.
  • tehlike 8y ago
    Suggest a usable way. Friendly to people.
    • tehlike 8y ago
      I hope downvoters see the reason why security is a compromise for user friendliness.
    • detaro 8y ago
      Instead of asking "Allow Epic Installer to install apps", have the option to ask "Allow Epic Installer to install apps by the same publisher", and have to OS do the signature check. This would cover the vast majority of app stores, especially if multiple signatures are allowed.
      • tehlike 8y ago
        This is fair, but more app stores also mean more points of failure. We learned quite a bit from what happens in cases like this from root ca's. We had to have certificate transparency, browsers distrusting ca's from vulnerable ca's and so on. So i would argue this is not as simple as that. I dont necessarily trust fortnite keeping their keys secure, for example.
        • deleted 8y ago
          [deleted]
    • gsich 8y ago
      Imagine something as your parent with a gui.
    • sparkie 8y ago
      If a user already has F-droid installed, they can scan a QR code, verify that the signature matches, or just click on URL. Example here: https://f-droid.monerujo.io/ https://f-droid.monerujo.io/ The only difficult part is the user getting f-droid on their device to begin with. If google play implemented the functionality provided by F-droid, they wouldn't need to. Manufacturers should just put F-droid on new devices as standard.
      • tehlike 8y ago
        Instead manifacturers install their adware, or their store...