Question - couldn't `trusted´ OSS individuals or organizations create their own keys and sign software? For example, if RedHat signed their kernels and binary distributions, or the Debian organization's key members published keys they created, open-source groups could trust them. For individual end users, it would boil down to "I personally believe (by having met them, or other experience) that 'Joe Blow' writes trustworthy software".

Of course, this doesn't solve the problem of a near-monopolistic group of content providers issuing DRM-locked music/video/.... which would only `trust´ keys generated by Microsoft. Perhaps a rational examination of the market they would be excluding by not trusting keys issued by large, reliable OSS providers could convince them otherwise.


[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/96/15729#15729