Hacker News Reader

> I feel like everyone who runs software has a strong incentive to determine the origin of it? Do you not feel that way?

Strong incentive no. In fact, most volunteer open source developers release their software with no legal liability at all (cf. MIT license).

View on HN

I guess I was thinking incentive beyond the legal - like, people often do things because they have desires outside of the legal code.

For example - even though the GPL contains, to the extent legally possible, an "as-is" clause like the MIT liscence, it's extremely common for GPL projects to publish information (ex: hashes, known good package repos, etc) that help people ensure they've gotten the software they expect. Sigstore seems like it's driving towards the same goal.

Reply on news.ycombinator.com