News for hackers. Stuff that matters.
Re:I'm a programmer – how can I help SciHub? by jazzyjackson on Sunday July 11, 2021 @03:44PM (#27804025)
Right it’s not insurmountable, authors can publish public keys and sign the files - it’s a UI/UX problem like everything else in crypto.

Keybase makes it fairly easy, but people still have to learn what it means and why it’s trustworthy - my bet is things don’t change, there is a small percentage of people who understand how to verify the source, and the general population who either believes anything or nothing.

In the context of scientists and professionals tho maybe it is achievable to do some outreach and get people on eg keybase, something user friendly

Re:I'm a programmer – how can I help SciHub? by ithkuil on Sunday July 11, 2021 @03:54PM (#27804078)
Most people I've been advocating Keybase to, just assumed it's yet another place where you create an account and hence you must trust them (now owned by zoom, boo-hoo).

I found it well explained etc, but it's hard to reach everybody.

Re:I'm a programmer – how can I help SciHub? by toomuchtodo on Sunday July 11, 2021 @10:10PM (#27806207)
Lets say Zoom wanted to sell Keybase. Lets say they wanted to sell it to someone like myself, who would run it in a non profit like a utility, similar to Let's Encrypt. Lets say I'd then integrate it with Stripe Identity and gov IDP providers (US: login.gov, UK: gov.uk verify). This would then allow you to publicly sign damn near everything with an identity you could choose to (but not be required to!) connect to your IRL identity.

That sounds what's needed, an extension of your IRL identity with top notch tooling to manage signatures (what PGP/GPG should've been) instead of docusign and similar that are charging an arm and a leg to "sign" PDFs with generated initials and signatures. We could go further; the signature is human readable in the rendered PDF (or whatever), and the Internet Archive takes a snapshot as an oracle notary when published, similar to Certificate Transparency for certs, but for all sorts of digital artifacts (the Internet Archive's snapshots have been used by a court of law for evidence authentication, so it's a trusted system [1]).

It ain't hard, it's just work.

[1] https://www.theregister.com/2018/09/04/wayback_machine_legit...