3 ms·
Considering GPG is the primary protection for the Linux distros that run most of the services we're discussing* , at some point our trust falls down to it anyho
by jasonh3 8y ago
Considering GPG is the primary protection for the Linux distros that run most of the services we're discussing* , at some point our trust falls down to it anyhow :)
* : Last I checked, the two most popular Linux distros I'm familiar with (CentOS and Ubuntu) only make their iso hashes available via http-only served files that are GPG signed
- acdha 8y agoThose distributions use GPG but they also use pre-deployed signing keys rather than, say, trusting any @debian.org key on a public keyserver. When you're centralizing trust like that anyway, the differences between that and a canonical Git repo don't seem to be especially significant from a practical standpoint.