Re:Signing .jars is not worth the effort
by quotemstr on Sunday July 26, 2020 @02:41PM
(#23959143)
The word you're looking for isn't "write-only". It's "immutable". And it's not the immutability that's responsible for the attack you're discussing, but the lack of a rooted chain of trust. You seem to be imagining a world in which the keyserver is responsible for authenticating the keys uploaded to it. I don't want to give the keyserver people that kind of power or responsibility.
[ Parent
| on HN ]
Re:Signing .jars is not worth the effort
by renewiltord on Sunday July 26, 2020 @02:49PM
(#23959207)
Interesting: I wouldn't describe an "append-only" database as "immutable" (after all, you are mutating it by adding things to it) but it appears that the common parlance actually does refer to databases that are append-only as immutable, perhaps as short hand for immutable-entry databases.
Annoys me disproportionately. But the people have spoken.
Yeah, it's like not you would call an in-memory B-tree immutable if you could only add more nodes but not change existing ones. Clearly other people are wrong and we should stand up for what is right!