Hacker News Reader

> alarmist

How so?

The author is voicing criticism that a lot of people (including myself) have with regards to the current state of software distribution security.

Furthermore, his survey of the top distributions is interesting for people who take their security seriously.

View on HN

It's misconstruing the problem as a primarily mitm threat. Considering the different methods of tampering with your download, I'd be more worried about server side compromises rather than otw

That doesn't mean we shouldn't mitigate MITM. Using either gpg or tls without the other makes the security of the system weaker than it needs to be. Gpg key authenticity can't be practically verified by end users.

I remain unconvinced.

Reply on news.ycombinator.com