News for hackers. Stuff that matters.

A comment on Ditching OpenPGP, a new approach to signing APT repositories. Parent comment

Re:Ditching OpenPGP, a new approach to signing APT repositories by deknos on Tuesday June 22, 2021 @07:33AM (#27590379)
> That's an absurd statement. OpenPGP _is_ the legacy cruft. It's made for _emails_. It makes no sense elsewhere. The encoding for clearsigned signatures is overly complex.

No. It's a message encryption, and namespaces are emails, but then, most logins nowadays are identifiers via some email. this is not true. and encodings are fixable and doable in a good library, so there's no misuse.

> And Rust is inappropriate in any case for now, it's not allowed in Ubuntu main.

that's new to me, but possible, why? any link?

[ Parent | on HN ]
Re:Ditching OpenPGP, a new approach to signing APT repositories by julian-klode on Tuesday June 22, 2021 @01:41PM (#27594688)
Rust is a security nightmare. We'd need to add over 130 packages to main for sequioa, and then we'd need to rebuild them all each time one of them needs a security update.
[ Parent | on HN ]