6 ms·
Not much point in serving .sig's and your PGP key if its over HTTP. Unless you're already in someone's WOT, there's nothing to verify against. At least if you u
by aroch 12y ago
Not much point in serving .sig's and your PGP key if its over HTTP. Unless you're already in someone's WOT, there's nothing to verify against. At least if you use HTTPS we can somewhat trust that we're being displayed the key you think we should be displayed.
- MichaelApproved 12y agoFor those wondering, I think WOT means "Web of Trust." This seems to be a tool related to that https://www.mywot.com/ https://www.mywot.com/
- tokenizerrr 12y agoNo, this is referring to the PGP Web of Trust https://en.wikipedia.org/wiki/Web_of_trust https://en.wikipedia.org/wiki/Web_of_trust https://www.gnupg.org/gph/en/manual.html#AEN554 https://www.gnupg.org/gph/en/manual.html#AEN554
- draugadrotten 12y ago> Unless you're already in someone's WOT, there's nothing to verify against. Somebody's been trying to fix that with https://keybase.io/ https://keybase.io/
- tokenizerrr 12y agoIf anyone is interested, I have 3 keybase invites to hand out. Contact is in my profile. edit: None left, sorry!
- fernandotakai 12y agoI have 7 invites. contact is also on my profile. edit: they are all gone.
- jnthn 12y agoI have 5 invites, contact in my profile. Edit: invite count update
- mrsteveman1 12y agoI've got 15 more if jnthn's run out :)
- BostonEnginerd 12y agoI also have a pile of invites.
- rlpb 12y agoIndeed; the key used doesn't even appear to be available on any keyserver. However, it does have some use in being able to determine that a newer release was made by the same person as the previous ones. That's something you can't get with HTTPS.
- eikenberry 12y agoAlso if they've had it their for a long time you could get some historical verification of it via archive.org.