3 ms·
> but the download and the hashed check come from the same site. If someone can spoof the download site Someone should tell the nixos devs that. Not being able
by h_anna_h 5y ago
> but the download and the hashed check come from the same site. If someone can spoof the download site
Someone should tell the nixos devs that. Not being able to verify the authenticity of something as important as your OS does not seem very safe.
- nullc 5y agoIf nixos is doing that they're not alone. Fedora is in essentially the same camp unless it changed in the latest release: It's pgp signed but with a totally new key with every release and that pgp key isn't signed by anything else, and the only way to verify it is ... to download it from the same place you got your iso from. A number of years back openssl changed their pgp key and for a month didn't publish it anywhere. AFAICT I was the first person to complain about it-- which also suggests that all the distros that had already shipped the update hadn't checked it.