3 ms·
That's just kicking the ball down the road. It is more reasonable to expect one developer to perform sufficient security work than to expect N users, some of wh
by melony 5y ago
That's just kicking the ball down the road. It is more reasonable to expect one developer to perform sufficient security work than to expect N users, some of whom may be non-technical, to check verified packages.
- capableweb 5y agoPackage managers don't force people to manually check the signature of downloaded packages, that all happens automatically. No balls kicked here :)
- melony 5y agoUploading to package managers (or convincing said managers to package your upstream, this is a particularly big problem for fragmented OSes like Linux desktops) also don't scale easily from the developer's side compared to configuring TLS which is usually a single toggle on your cloud host's DNS config.
- capableweb 5y agoIf I had to chose between developer signed packages and TLS, I'd go with signed packages, because at least then I know I get what the developer intended to give me, no questions asked. TLS guarantees security in transport, yes that's true, but a package signed by the developer guarantees that even if the mirror itself been compromised and still has a valid TLS connection, my system won't install a rogue dependency. Luckily in our real world, we can have both of them, and that's of course best :)