4 ms·
> The solution is to tie a package to an identity using a certificate. Identity on the Internet is a lie. Nobody knows you're a dog. The solution is to make s
by rollcat 1y ago
> The solution is to tie a package to an identity using a certificate.
Identity on the Internet is a lie. Nobody knows you're a dog.
The solution is to make security easy and accessible, so that the user can't be confused into doing the insecure thing.
- lelanthran 1y ago> Identity on the Internet is a lie. What do you think HTTPS is?
- mdaniel 1y agoTransport Layer Security, and has nothing to do with Identity. Take for example the perfectly valid certificate that was issued for npmjs[.]help which unquestionably does not belong to Microsoft/GitHub. Hell, even the certificate for npmjs.com is 'O=Google Trust Services' which doesn't sound like any of the business entities one would expect to own that cert
- rollcat 1y ago"Whoever was on the cacert list that ships with your browser" has signed "I claim to be Acme Widgets Inc. and I own microsoft.com".