Hacker News Reader

https also provides secure authentication, not merely encryption. The encryption part also guarantees the authentication part by proving that the stream can not have been modified.

In order to meet this guarantee for the scheme you're discussing, the hashes themselves need to have a tamper evident. What is this tamper evident?

View on HN

Yes, that's clear.

I'm not very familiar with how quicklisp works. I thought that “updates once a month” implies a separate update channel (distribution, ...).

Looking at the relevant issue, https://github.com/quicklisp/quicklisp-client/issues/167 , it's not clear that even hashes are in place.

I recently found out that most Nix fetchers use https, but do not actually do verification (`curl --insecure` or equivalent libcurl settings). Channel updates do verify and include hashes, so the overall chain is authenticated.

Reply on news.ycombinator.com