4 ms·
It's bizarre that they consider https as an alternative to cryptographic signing, rather than an unrelated addition.
by vacri 11y ago
It's bizarre that they consider https as an alternative to cryptographic signing, rather than an unrelated addition.
- nickpsecurity 11y agoMy reading was they did the exact opposite: considered https to be a failure of end-to-end security they wanted. It was various users that apparently wanted HTTPS. I could see how they got to that: I access the site with HTTP; an intercept might happen; HTTPS protects HTTP; let's protect it with HTTPS! Fortunately, the experts knew better and avoided that nonsense.
- what_the_diffie 11y agoIf end-to-end sec (e.g., crypto signatures) are used, like say with Debian packages which uses GPG, packages and metadata can be released over http without a problem.
- nickpsecurity 11y agoExactly. One of many reasons the developers went with an end-to-end solution instead of HTTPS. It makes the transport mechanism moot except for the initial key exchange.