3 ms·
But aren't you still trusting the website for instructions about how to verify the cryptographic signatures?
by xyzzy123 1y ago
But aren't you still trusting the website for instructions about how to verify the cryptographic signatures?
- KAMSPioneer 1y agoThe idea (outlined in the QubesOS documentation) is to clone the git repo of their website, verify the PGP commit signatures, then render the website yourself. Then you can be reasonably sure the website is legitimate, modulo a DoS attack stopping you from receiving updates to the website code, I suppose. Getting the correct PGP public key appears to be an exercise left to the reader, but if you are already running e.g. Fedora, you can view the packaged QubesOS distro keys distributed by your current OS, cross-reference that with a second source such as a PGP keyserver, and unless you're being Mossaded upon you're probably good if they match.
- zahlman 1y agoIt's a standard procedure that could be learned in many other ways.