Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It would allow you to verify the authenticity of the gems, even if the server had been compromised.

(This isn't a new technique -- for example, .deb packages distributed through APT are usually signed with gpg -- IIRC, this was a measure introduced years ago in response to a Debian mirror being compromised.)



(my knowledge is circa early 2000s)

Debian has (had?) a high barrier to entry to become a developer, and every developer signs their packages. The release binaries are arranged on a secured box and the release key itself is held by a limited set of people.

In short, the signatures work because of the human element and organizational structure of Debian.

Rubygems accepts submissions from the general public.

So, again, I don't see how it would have helped.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: