upvote
I trust myself way more to with with a pgp key on my computer than figuring out how to use GitHub actions properly...
reply
The problem is no one else does. Github workflow is at least public and auditable. Your personal computer is not.
reply
So what? Ultimately the trust model is supposed to be there to validate that this latest blob of code is coming from the same source as the last blob of code for the same project, authenticated with the same public key. And that's all it is telling you, and all that it can tell you, whether the attestation is generated during a Github workflow or by a program running on my personal computer that you can't see. It is not telling you that this latest blob of code is safe and free from problems. It's just telling you that it comes from the same source.
reply
The average person using GPG isn’t actually providing me much evidence in that regard, given the number of ways to have technically used a GPG key to sign an artifact that aren’t secure.
reply
That's easy to handle: if the signature isn't secure, it doesn't count as an attestation. I have no problem with putting the onus on the person doing the signing to do it right. But at present doing it right on your own is not even an option. Only going through one of the tech giants is.
reply
How is PyPI supposed to tell if the person signing the artifacts is handling their key securely?
reply
They can't. But they can't tell for sure if large tech corporations are doing that either. Data breaches are a thing. Auditing Github workflows doesn't prevent them.
reply
Microsoft can't even figure out how to send email reliably. But sure everyone should trust them with signing packages.
reply
1. "ClosedAI" is not gonna win people over to your side, IMHO. Apple doesn't plant trees, Microsoft makes big hardware, and Python is not satanic.

2. I'm not entirely sure what the link is supposed to prove -- would appreciate a word of clarification if you find the time. It almost feels like a dogwhistle of some kind, but A) I doubt anyone on HN is anywhere near that problematic, and B) there's no clear pattern in those companies other than "interested in ID tech", and none of the usual dogwhistle targets made the list. Also, y'know, OpenAI isn't on it...?

I guess my fundamental confusion isn't about the list and more about what "we know". Are you implying that they are against pure, unmanaged PGP for this system because... I mean, why? Because they're playing the long game to promote a verification/attestation/identification (?) technology that you think offers less stringent privacy guarantees, and thus to sell more ads in 2036?

If so, doesn't that seem like a kinda roundabout way to raise Display Ads revenue, otherwise known as "that one dying industry"?

reply
[flagged]
reply
Are... are you creating new hackernews accounts for every comment? Why?

Anyway, sorry to confuse/frustrate, I was being honest and tried to explicitly not accuse you of dogwhistling. I was making a best-effort attempt to explain my confusion, rather than just replying with "that doesn't make any sense" or something.

I guess I'll briefly elaborate just in case: "dogwhistle" above refers to a specific kind of antisemetic practice where people point at a list of companies or institutions or even just people and say something like "what do you notice?", whith the message ofc being that they're all related-to/run-by Jewish people. Again, not accusing you of that -- those people don't generally come here. But absent any other logic, I am left with confusion.

I will briefly add that this very response also doesn't help, when you very clearly imply that I am "shooting down a comment" in bad faith for some sinister purpose. It, again, comes off as conspiratorial. Why would I --a sad 30 y/o child with my real name and phone number in my bio-- be shooting this down?

I guess my overall response is that this feels like a conspiracy theory without identifying the conspiracy.

reply
[flagged]
reply