News for hackers. Stuff that matters.

A comment on GitLab discovers widespread NPM supply chain attack. Parent comment

Re:GitLab discovers widespread NPM supply chain attack by gruez on Friday November 28, 2025 @08:23AM (#46078419)
PGP keys don't tell you anything about a developers "real identity". Theoretically theres some "web of trust", but realistically everyone just blindly downloads whatever PGP key is listed on the repo's install instructions.
[ Parent | on HN ]
Re:GitLab discovers widespread NPM supply chain attack by brabel on Friday November 28, 2025 @05:42PM (#46083462)
Bullshit. The public key can be obtained by several easy means, like visiting the publisher website or social network site like GitHub which is common. That verifies the identity just as well as any certificate! But with much less trouble.
[ Parent | on HN ]
Re:GitLab discovers widespread NPM supply chain attack by gruez on Friday November 28, 2025 @06:55PM (#46083937)
How are you still missing the "real identity" part? A bitcoin address might be easily verifiable, but isn't anyone's idea of "real identity".
[ Parent | on HN ]
Re:GitLab discovers widespread NPM supply chain attack by brabel on Saturday November 29, 2025 @04:09PM (#46090787)
Real identity is impossible to establish beyond any doubt, and a certificate is no better than a key on a website, in fact it's essentially the exact same thing.
[ Parent | on HN ]