3 ms·
How does Crev's web of trust work !? What if the malicious user creates a bunch of fake id's to sign the compromised code ?
by z3t4 8y ago
How does Crev's web of trust work !? What if the malicious user creates a bunch of fake id's to sign the compromised code ?
- riffraff 8y agoWho would trust those?
- z3t4 8y agoThen the question becomes, how do you know who to trust ? Are you supposed to also vet the id-hashes of the signers ?
- sgeisler 8y agoI guess you will trust coworkers, people you know irl, well known developers, companies you pay for review subscriptions. You don't have to trust all of them 100%if you require multiple reviews per dependency.
- mikekchar 8y agoI have a similar thought. WoT relies upon authentication. How does Crev do authentication? What methods are used for key revocation, etc? It didn't seem to me that they were tackling that directly but relying on a proper use of underlying technology. Possibly I'm wrong or possibly they haven't got that far, but I'd love to see a more explicit description of exactly what they've thought out so far.