News for hackers. Stuff that matters.

A comment on Creating signed GitHub releases. Parent comment

Re:Creating signed GitHub releases by edwintorok on Thursday April 14, 2016 @09:28AM (#11496460)
Github doesn't have your private key, so they won't be able to serve a valid signature. The only thing they could do is to substitute an older signed version when you request a newer version.
[ Parent | on HN ]
Re:Creating signed GitHub releases by ashitlerferad on Thursday April 14, 2016 @09:53AM (#11496645)
They could create a new private key using your name. Most people will trust 'Verified' on a web page more than the OpenPGP web of trust.
[ Parent | on HN ]
Re:Creating signed GitHub releases by makomk on Friday April 15, 2016 @06:41AM (#11503328)
Most people will, but this is written by a Debian developer and they're one of the few groups of people who actually make use of the OpenPGP web of trust.
[ Parent | on HN ]
Re:Creating signed GitHub releases by ashitlerferad on Thursday April 14, 2016 @12:55PM (#11498351)
To emphasise this, there is an evil duplicate of the OpenPGP "strong set" here:

https://evil32.com/

[ Parent | on HN ]
Re:Creating signed GitHub releases by sneak on Thursday April 14, 2016 @10:39AM (#11497076)
Not sure why you're being downvoted, this "what is the threat model here" was my first thought, too, and this comment is also correct, as well.
[ Parent | on HN ]
Re:Creating signed GitHub releases by ashitlerferad on Thursday April 14, 2016 @11:14AM (#11497343)
Probably my "Most people" quip.
[ Parent | on HN ]
Re:Creating signed GitHub releases by zokier on Thursday April 14, 2016 @11:42AM (#11497591)
The xkcd trust model https://xkcd.com/1181/
[ Parent | on HN ]