3 ms·
Yes SSL or GPG is nice and provides some level of security, but think of the more fundamental problem: you're installing new software from a group of people you
by andreasvc 13y ago
Yes SSL or GPG is nice and provides some level of security, but think of the more fundamental problem: you're installing new software from a group of people you probably don't know, it's going to be a leap of faith either way. What you talk about are technical measures that in no way address the social problem of establishing trust in the people making those signatures.
- e12e 13y agoYou're missing my point. Even if I trust saltstack, I can't trust whatever comes down over an http link. If they'd signed it (with gpg or ssl) -- then I could choose to trust the code. I'm more than ready (perhaps foolishly) to trust the code from some random group of people -- but I need to be able to trust that code -- not whatever comes down off a possibly spoofed http link. Without signatures of some kind, there can't be any trust. It doesn't matter if I trust Debian to release a good distribution if I have no way to know if the software I'm installing is from Debian.