News for hackers. Stuff that matters.

A comment on The sad state of Linux download security. Parent comment

Re:The sad state of Linux download security by tyho on Sunday July 17, 2016 @05:35PM (#12111962)
All signed, with the signature keys delivered over HTTP, just as the site states.
[ Parent | on HN ]
Re:The sad state of Linux download security by detaro on Sunday July 17, 2016 @05:43PM (#12112018)
https://software.opensuse.org/ offers the GPG fingerprint over HTTPS. A bit curious that they don't enforce HTTPS for this page, but it is there.

And the key has been the same for years, so there are quite a few independent sources quoting it, which helps to verify it.

[ Parent | on HN ]
Re:The sad state of Linux download security by rbrownsuse on Sunday July 17, 2016 @05:41PM (#12111998)
the site states that openSUSE does not sign it's checksums or provide instructions on how to verify them

Both claims are demonstrably false.

[ Parent | on HN ]