Re: [GNU-linux-libre] Help users to verify their downloads

[bill-auger]

On Mon, 2018-06-25 at 11:33 +0200, Jean Louis wrote:
> If users don't know how to verify PGP fingerprints
> with the issues of the PGP key, and it is anyway
> unlikely that any serious percentage would be
> doing so, then we are wasting time by creating
> apparent security.

it is why package managers such as apt and pacman run the verifications
implicitly so that the user does not need to know how it is done - i think this
discussion was prompted more in terms of downloading ISOs and installers - to
this ill add to that the parabola ISO can actually be made by any user of a
parabola system - one simply installs the 'parabolaiso' package and runs a
single command to generate a pristine ISO

of course you need an existing arch or parabola system to bootstrap this but
perhaps your neighbor has one but this ties Jean's reply into the one i posted a
few days ago showing that a community user-base can itself be a security feature
as long as someone in the community can advise and assist others and those
others know where to ask

the guix "blob-challenge" is another example of this

signature.asc
Description: This is a digitally signed message part