4 ms·
I should have posted the https link. If a mod wants to edit the url for this, twould be appreciated. cperciva, why serve http at all or not at least redirect p
by malandrew 13y ago
I should have posted the https link. If a mod wants to edit the url for this, twould be appreciated.
cperciva, why serve http at all or not at least redirect people to https by default?
- cperciva 13y agowhy serve http at all Any sane packaging system will check hashes against known good values after downloading, so using https just opens up more attack surface.
- hueving 13y agoIf they're not using http, where exactly do the known good values come from?
- cperciva 13y agoThe GPG-signed release announcement.
- hueving 13y agoWhile valid, this is an extremely user hostile response. Requiring administrators to dig up release notes and hoping they actually have your gpg key and know what to do with it is essentially giving the middle finger to admins that don't understand crypto well.
- jasomill 13y agoNot really, because admins that don't bother to read release notes or to verify GPG keys should probably be using package management systems maintained by those who do.
- hueving 13y agoThat would be fine if there were never a case where a package management system fell out of date due to a package maintainer not staying on top of things.
- junglhilt 13y agoHow would they get the GPG key securely?