News for hackers. Stuff that matters.

xloem

xloem on Hacker News

Re:Ditching OpenPGP, a new approach to signing APT repositories on Tuesday June 22, 2021 @08:40PM (#27599294)
> APT would maintain a list of allowed public primary keys.

You've blatantly forgotten the implication of TOFU regarding new debian keys. Without a way to certify debian's keys, there's no way to verify that installation media is correct any more. With PGP, there was the web of trust. Now there is TLS at best, no?

It seems the proposed specification lacks a crucial addition of keysigning.