3 ms·
> It kind of works that way in Linux world where artifacts are PGP signed and to get your key into distro store one has to have "reputation". With the caveat th
by msla 8y ago
> It kind of works that way in Linux world where artifacts are PGP signed and to get your key into distro store one has to have "reputation". With the caveat that different distros have different schemes.
... none of them financial.
I'm not saying that financial incentives are bad, necessarily, but I am saying that being able/forced to buy your way in privileges the most organized scammers, the ones who have a cogent business plan to make money from their chicanery and some seed capital, over programmers who don't have money, have no expectation of making money, and are only motivated by getting their code out there and used.
Debian has a Social Contract. Microsoft has a pricetag. I know which of them Adobe is more comfortable with.
- Leace 8y ago> I am saying that being able/forced to buy your way in privileges the most organized scammers This works both ways because legitimate software developers also don't have easy ways of pushing their signed software to end users. Usually step 1 in installing software from external developer is "get my PGP key imported" [0]. [0]: https://www.sublimemerge.com/docs/linux_repositories https://www.sublimemerge.com/docs/linux_repositories I don't mean Linux distro's model is worse or that Windows model is better. What I mean is that none of them is significantly better than the other. Just different with different trade-offs.
- acqq 8y ago> Usually step 1 in installing software from external developer is "get my PGP key imported" [0]. Even #%@! Oracle does it: https://www.virtualbox.org/wiki/Linux_Downloads https://www.virtualbox.org/wiki/Linux_Downloads I wonder what’s the point of the PGP key then.
- Leace 8y ago> I wonder what’s the point of the PGP key then. Trust on First Use. Once the key is imported it stays the same. People working for that organization can sign the key to attest it's real (Web of Trust). Although I wonder how would they check it. Organization (non-individual) keys are weird because ultimately it's just an individual behind it.