5 ms·
Is it enough? http://blog.bintray.com/2014/08/04/feel-secure-with-ssl-think-again/ http://blog.bintray.com/2014/08/04/feel-secure-with-ssl-thin...
by jbaruch_s 12y ago
Is it enough?
http://blog.bintray.com/2014/08/04/feel-secure-with-ssl-think-again/ http://blog.bintray.com/2014/08/04/feel-secure-with-ssl-thin...
- iancarroll 12y agoThe author seems to forget that a key server makes no validation assurances, it just hosts said key. There are various other flaws in it and he doesn't seem to understand how the PGP WoT works...
- jbaruch_s 12y agoThe author of what?
- jackweirdy 12y agoPresumably the post you just linked to
- kaoD 12y agoWhich based on the blog author and the HN username, is himself.
- jbaruch_s 12y agoWell, in that case @iancarroll didn't read the post. What he claims I don't understand is exactly what the post says.
- holdenbaggins 12y agoI think @iancarroll is pointing out that you seem to be conflating signature and identity verification. They are different concerns, yet both are both necessary for secure software distribution. Fine if you reject web-of-trust style identity verification, but your notion of "web identity verification" is not in any way a good substitute for code signature verification. What if someone compromises your hosted repository? Unless your artifact were already cryptographically signed, no amount of identity verification is going to help you.
- jbaruch_s 12y agoThat's very true. That's why Bintray has both "web identity verification" and pgp signing, while Maven Central gives you signing only, without a way to really identify the author.
- deleted 12y ago[deleted]