News for hackers. Stuff that matters.

A comment on 21 years after the request OpenPGP support gets added to Thunderbird. Parent comment

Re:21 years after the request OpenPGP support gets added to ... by trishankdatadog on Thursday September 17, 2020 @11:49PM (#24512799)
> software update cryptography is both a solved problem (just use signify)

Well, just use TUF [1] and in-toto [2] ;)

[1] https://theupdateframework.io/

[2] https://in-toto.io/

[ Parent | on HN ]
Re:21 years after the request OpenPGP support gets added to ... by theamk on Friday September 18, 2020 @04:13PM (#24521403)
Note that TUF is great for things with multiple contributiors (think npm or pypa).

For the simple case of "a single publisher publishes update for a single product", TUF is an overkill. Something like signify or seccure will be way easier to set up and use.

[ Parent | on HN ]
Re:21 years after the request OpenPGP support gets added to ... by trishankdatadog on Monday September 21, 2020 @02:11PM (#24546574)
signify is nice when key distribution, revocation, and rotation is handled for you... but how do you do that securely for many different publishers on a single repo?
[ Parent | on HN ]