Re:Crev: dependency vetting with a web of trust
by jake_the_third on Saturday January 05, 2019 @12:01AM
(#18830002)
> only centralized webs of trust work
How can you claim that? Looking at most tech we have today, it becomes readily apparent that most technology needs multiple iterations before achieving wide adoption. Web of trust is no exception.
The lack of a widely-adopted precedent implying that some tech is forever poor is a sloppy conclusion to make.
Re:Crev: dependency vetting with a web of trust
by stcredzero on Saturday January 05, 2019 @04:01PM
(#18834225)
The lack of a widely-adopted precedent implying that some tech is forever poor is a sloppy conclusion to make.
Yes, but decentralized webs of trust have been tried before, and the "flat" ones with no centralization fade away or become hipster tchotkes. I think it's a valuable question to ask. Have we done the analyses for why the previous ones didn't work?
This of course raises the question: what if someone puts some malware in a crate?
Do decentralized web of trust schemes actually work? What are the precedents? AFAIK, only centralized webs of trust work, and even those still leak around the edges and take some degree of active policing to defend. Basically, someone (or maybe a few competing someones) with authority establishes a canonical boundary and publishes a canonical list.