This is incredible. We need end to end security without this https insanity as a bandage more than ever. Ubiquitous signing and audit logs more than ever. Tool

This is incredible. We need end to end security without this https insanity as a bandage more than ever. Ubiquitous signing and audit logs more than ever. Tools that, for normal end users, refuse to work if integrity is broken. What sourceforge is doing should be universally seen as damage and systematized intolerance should make the attempt pancake so hard and so fast that nobody ever even tries it. It's excellent that the nmap people distribute gpg sigs. Now we need socialize the fact that "https does not mean I'm getting want I wanted from the original authors", and start building (yes, we need to get past the http://www.thoughtcrime.org/blog/gpg-and-me/ http://www.thoughtcrime.org/blog/gpg-and-me/ problems) and using tools that do better.