Re:Crev: dependency vetting with a web of trust
by z3t4 on Friday January 04, 2019 @04:26PM
(#18827790)
Then the question becomes, how do you know who to trust ? Are you supposed to also vet the id-hashes of the signers ?
[ Parent
| on HN ]
Re:Crev: dependency vetting with a web of trust
by sgeisler on Friday January 04, 2019 @05:30PM
(#18828339)
I guess you will trust coworkers, people you know irl, well known developers, companies you pay for review subscriptions. You don't have to trust all of them 100%if you require multiple reviews per dependency.