What is GPG and why you should start using it

armitron10mo ago

Forging a signature is super hard, man-in-the-middling an HTTPS connection can be very easy (example: a lot of corporate environments do it).

landgenoot10mo ago

Package managers don't use https on purpose in order to make it easy to cache a repository.

This is alright from a privacy perspective, because you can find out which packages are downloaded anyway by looking at the download sizes.

SkiFire1310mo ago

Supposedly you would get the GPG key from somewhere else, ideally through a web of trust, although I find it hard to do in practice

armitron10mo ago

Even if you don't get the public key through a web of trust, you download it "once" not every time you download a file, then you keep using it until it expires.

You also typically download it from a different place than the storage location of the signed binary artifacts. This means that an adversary will have a hard time trying to replace a public key and remain undetected.

What is GPG and why you should start using it (opens in new tab)

What is GPG and why you should start using it (opens in new tab)

5 comments

5 comments