4 ms·

hachyderm.io says it has a validated link to his homepage, but if you don't already trust hachyderm.io that means nothing.

viraptor 1y ago
It means a lot - you need to check the other side's meta to confirm yourself. https://fedi.tips/how-do-i-verify-my-account/ https://fedi.tips/how-do-i-verify-my-account/
- mjmas 1y ago
  For example, at https://www.chiark.greenend.org.uk/~sgtatham/ https://www.chiark.greenend.org.uk/~sgtatham/ : (the rel=me is the important part) [...] <a rel="me" href="https://hachyderm.io/@simontatham"> [...]
- closewith 1y ago
  No, it really means nothing. Identity on the internet is not a solved problem.
  - pferde 1y ago
    You are wrong. It means that whoever owns the website marked as verified also owns the social account. See https://joinmastodon.org/verification https://joinmastodon.org/verification for a quick overview of how it works.
    - closewith 1y ago
      No, it means a certain link exists on the website. On Hacker News of all sites, I would think we should all know that's not sufficient evidence of identity for an update regarding the source of critical software like a terminal.
      - viraptor 1y ago
        Nobody claimed it validates the identity in any way. It validates that the person at the other website confirms it's their social account and the social account matches the other direction. The real identity is not involved here in any way and never was. You're disagreeing with someone nobody here raises. But the link validation confirms that if you believed that the original download site belongs to the author, then you would have almost the same guarantee about the social account. (+/- the chances of the putty website being hacked)
        closewith 1y ago
        Yes, your caveat at the end there is exactly why this method shouldn't be trusted, as it's indistinguishable from an attacker with access to embed a single link. So it doesn't confirm the account belongs to the author, it confirms the site has a specific link and nothing more.
        Ukv 1y ago
        A regular link won't do, since it requires the rel="me" attribute, which is intended for this purpose: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Attributes/rel/me https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/... Adding a <meta> tag or creating a page with certain content are already used even for more impactful verification, like getting issued a certificate for that domain. If an attacker does have broad access to edit the HTML of your website, I feel that's already the issue and Mastodon verifying that "this person controls this website" isn't even really wrong.
        closewith 1y ago
        So you have read that page and understand its purpose is to link social media profiles for informational purposes, but don't understand that it's not suitable for any kind of auth, let alone in a software supply chain?
        1y ago
- nottorp 1y ago
  And that's why the fediverse thing is so niche :) Looks like it's as complicated as a parts inventory system developed in house for a half a million employee company...
  - viraptor 1y ago
    There's a link on one side and a meta tag on the other. It's as simple as you can make the validation between two sites. It's not even fediverse-specific really - there were other services doing something similar before.
  - bentinata 1y ago
    It's because freedom and correctness is hard. Yeah, most people prefer convenience and would rather someone be the source of authority to do it for them, but people on fediverse are not those kind of people.
aembleton 1y ago
If you check the source of the website that it links to [1], on line 168, we have this <p>I'm on Mastodon as <a rel="me" href="https://hachyderm.io/@simontatham">@simontatham@hachyderm.io</a>.</p> If you trust that website, then you can be sure that this Mastodon account is the right one. 1. https://www.chiark.greenend.org.uk/~sgtatham/ https://www.chiark.greenend.org.uk/~sgtatham/
- kelnos 1y ago
  Sure, but by the time you've verified that, you could also have just visited the PuTTY website (the old/current one) to verify that putty.software is legit.

viraptor 1y ago

It means a lot - you need to check the other side's meta to confirm yourself. https://fedi.tips/how-do-i-verify-my-account/ https://fedi.tips/how-do-i-verify-my-account/

mjmas 1y ago
For example, at https://www.chiark.greenend.org.uk/~sgtatham/ https://www.chiark.greenend.org.uk/~sgtatham/ : (the rel=me is the important part) [...] <a rel="me" href="https://hachyderm.io/@simontatham"> [...]
closewith 1y ago
No, it really means nothing. Identity on the internet is not a solved problem.
- pferde 1y ago
  You are wrong. It means that whoever owns the website marked as verified also owns the social account. See https://joinmastodon.org/verification https://joinmastodon.org/verification for a quick overview of how it works.
  - closewith 1y ago
    No, it means a certain link exists on the website. On Hacker News of all sites, I would think we should all know that's not sufficient evidence of identity for an update regarding the source of critical software like a terminal.
    - viraptor 1y ago
      Nobody claimed it validates the identity in any way. It validates that the person at the other website confirms it's their social account and the social account matches the other direction. The real identity is not involved here in any way and never was. You're disagreeing with someone nobody here raises. But the link validation confirms that if you believed that the original download site belongs to the author, then you would have almost the same guarantee about the social account. (+/- the chances of the putty website being hacked)
      - closewith 1y ago
        Yes, your caveat at the end there is exactly why this method shouldn't be trusted, as it's indistinguishable from an attacker with access to embed a single link. So it doesn't confirm the account belongs to the author, it confirms the site has a specific link and nothing more.
        Ukv 1y ago
        A regular link won't do, since it requires the rel="me" attribute, which is intended for this purpose: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Attributes/rel/me https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/... Adding a <meta> tag or creating a page with certain content are already used even for more impactful verification, like getting issued a certificate for that domain. If an attacker does have broad access to edit the HTML of your website, I feel that's already the issue and Mastodon verifying that "this person controls this website" isn't even really wrong.
        closewith 1y ago
        So you have read that page and understand its purpose is to link social media profiles for informational purposes, but don't understand that it's not suitable for any kind of auth, let alone in a software supply chain?
        1y ago
nottorp 1y ago
And that's why the fediverse thing is so niche :) Looks like it's as complicated as a parts inventory system developed in house for a half a million employee company...
- viraptor 1y ago
  There's a link on one side and a meta tag on the other. It's as simple as you can make the validation between two sites. It's not even fediverse-specific really - there were other services doing something similar before.
- bentinata 1y ago
  It's because freedom and correctness is hard. Yeah, most people prefer convenience and would rather someone be the source of authority to do it for them, but people on fediverse are not those kind of people.

aembleton 1y ago

If you check the source of the website that it links to [1], on line 168, we have this <p>I'm on Mastodon as <a rel="me" href="https://hachyderm.io/@simontatham">@simontatham@hachyderm.io</a>.</p> If you trust that website, then you can be sure that this Mastodon account is the right one. 1. https://www.chiark.greenend.org.uk/~sgtatham/ https://www.chiark.greenend.org.uk/~sgtatham/

kelnos 1y ago
Sure, but by the time you've verified that, you could also have just visited the PuTTY website (the old/current one) to verify that putty.software is legit.