3 ms·
> PGP has a web-of-trust aspect, allowing people to trust people Must be great for the 5 people on the planet that maintain a personal web of trust with PGP wh
by NavinF 4y ago
> PGP has a web-of-trust aspect, allowing people to trust people
Must be great for the 5 people on the planet that maintain a personal web of trust with PGP while the rest of us just run whatever "curl|gpg --import" command the download page tells us to run, thus adding zero security on top of https.
- remram 4y agoThe alternative is this, you get a nifty certificate from Sigstore that allows you to be sure that "somerando@outlook.com" has indeed authored the lib you depend on. How do you check if that's what you want? How much security do you get from knowing that the email is definitely correct for a person you know nothing about?