4 ms·

Because I'm trusting individual package maintainers directly, not a suite of shady CAs. Have you ever looked at the list of trusted CAs? They're large, opaque,

Because I'm trusting individual package maintainers directly, not a suite of shady CAs. Have you ever looked at the list of trusted CAs? They're large, opaque, and shady businesses that I want no dealings with. CAs don't establish trust, they just establish privacy. I could go make myshadysite.com and get a certificate for it and serve malware. I trust Alpine Linux, not Alpine Linux's certificate authority. And for the record, the initial iso download is secured with SSL. I can also establish trust through my other Alpine installs, with friends who have also installed Alpine, via magnet links from friends (which are inherently sha'd), by emailing several package maintainers and cross verifying their signatures, consulting keyservers, etc. However you do it, once you establish the initial trust PGP is a superior option to SSL.

Boulth 8y ago
> I trust Alpine Linux, not Alpine Linux's certificate authority. Did you check and sign Alpine's maintainers key yourself or do you rely on the Web of Trust to create a path between you two? In the latter case every person in between of you two is acting like a certification authority.
- Sir_Cmpwn 8y ago
  Yes, but all of those authorities are just people. Not hundreds of businesses with ulterior motives. Plus, compromising one WoT PGP key doesn't break the whole system like one compromised CA will.
zamadatix 8y ago
> Because I'm trusting individual package maintainers directly, not a suite of shady CAs. Have you ever looked at the list of trusted CAs? Again, CAs are only needed for PUBLICLY signed certs but we are talking about a PRIVATELY managed trust and repo. The repo cert can be self-signed by the Alpine group and added to the root store during install the same as a PGP key can be added during install. No 3rd party "trust" involved.
- Sir_Cmpwn 8y ago
  I addressed this comment here: https://news.ycombinator.com/item?id=17983271 https://news.ycombinator.com/item?id=17983271

Boulth 8y ago

> I trust Alpine Linux, not Alpine Linux's certificate authority. Did you check and sign Alpine's maintainers key yourself or do you rely on the Web of Trust to create a path between you two? In the latter case every person in between of you two is acting like a certification authority.

Sir_Cmpwn 8y ago
Yes, but all of those authorities are just people. Not hundreds of businesses with ulterior motives. Plus, compromising one WoT PGP key doesn't break the whole system like one compromised CA will.

zamadatix 8y ago

> Because I'm trusting individual package maintainers directly, not a suite of shady CAs. Have you ever looked at the list of trusted CAs? Again, CAs are only needed for PUBLICLY signed certs but we are talking about a PRIVATELY managed trust and repo. The repo cert can be self-signed by the Alpine group and added to the root store during install the same as a PGP key can be added during install. No 3rd party "trust" involved.

Sir_Cmpwn 8y ago
I addressed this comment here: https://news.ycombinator.com/item?id=17983271 https://news.ycombinator.com/item?id=17983271