Trusted-apt (was [ILUG] Hypocrisy? )

[Darragh Bailey]

Quoting Stephane Dudzinski <stephane at cp.dias.ie>:

> And here's the exact message : 
> http://slashdot.org/comments.pl?sid=93397&cid=8019621
> 
> Anyone have been using/testing the trusted-apt he's referring to ?
> Steph

I assumed that debian packages were already using pgp signing to authenicate 
that the came from who you expected them to come from. Know that pgp is used 
for all the rpms that I download and install (automated so will bomb out of 
install if signiture wrong).

But once you use package signing, doesn't it all come down to the same thing, 
trust of the supplier. After all, secure connections to a server just mean 
that yes your retreiving these from the server, but you still have to trust 
whoever put them up there.

tbh, no matter how many layers of security are put between the server and you, 
it all depends on whether you trust the person that created the package. To my 
mind pgp is sufficient, cause if you don't trust the creator you shouldn't 
install any of their packages anyway, no matter where you get them from.

-- 
Darragh

"Nothing's foolproof to a sufficently talented fool"