Post #1398881

2026-03-24 07:50 UTC

@hyc @coderanger @malwareminigun Thank you. I guess I think of a "relationship" layer as such an obvious thing to add on top of a plain web of trust that I sometimes conflate the two. I'll agree 100% that "just" a web of trust and nothing more isn't all that useful.

Replies (1)

@malwareminigun@infosec.exchange 2026-03-24 18:29

@chansecodina @hyc @coderanger I guess my problem with this direction is that I don't think it really addresses the problem. It's taking the real problem, the JiaTan situation, and saying "well we can't solve that problem, but we can solve this appears to be related problem over here" but IMO that apparently unrelated problem isn't one that actually matters. At the end of the day the 'root of trust' for a particular project or component is functionally their website, and TLS shuts down the easy/practical ways to insert oneself into that. Most certificate exchange or hashing mechanisms would also be delivered via the same website so compromise of that is compromise of everything. And things like BOMs tend to give a false sense of 'security' being offered by what is morally an attestation.

Open ##1398884