News for hackers. Stuff that matters.

A comment on Nix as OS X Package Manager. Parent comment

Re:Nix as OS X Package Manager by falcolas on Wednesday May 25, 2016 @06:52PM (#11773811)
Generally, the key already exists on your system, as it's coming through the official channels. If you decide to add the cert manually, you can inspect the key and see who has signed it, and decide your level of trust.

With HTTPS, you only ever have the choice of trusting the 1000+ CAs in your keyring.

[ Parent | on HN ]
Re:Nix as OS X Package Manager by oconnore on Wednesday May 25, 2016 @09:05PM (#11774464)
> If you decide to add the cert manually, you can inspect the key and see who has signed it, and decide your level of trust.

No one has signed it, because the mythical web of trust does not exist. What now?

[ Parent | on HN ]
Re:Nix as OS X Package Manager by falcolas on Wednesday May 25, 2016 @11:07PM (#11775064)
Contact the developer (say, over IRC, Slack, email, GitHub, etc), and ask them to sign a sentence you provide with it. Then you can sign their key.
[ Parent | on HN ]