• 1 Post
  • 31 Comments
Joined 4 years ago
cake
Cake day: October 28th, 2020

help-circle





  • federico3@lemmy.mltoOpen Source@lemmy.mlEnshittification of GitHub?
    link
    fedilink
    English
    arrow-up
    4
    ·
    edit-2
    5 months ago

    Github is designed to centralize git (as the word “hub” suggests). You can still migrate away code, issues and wikis, but contributors, followers, wiki editors, issue subscribers, visibility in general and github stars are locked in. Discoverability matters to projects trying to attract contributors.














  • This is not correct. APT always verifies cryptographic signature unless you explicitly disable it. Yet it’s very important to understand who is signing packages. What kind of review process did the software go through? What kind of vetting did the package maintainer themselves go through?

    If software is signed only by the upstream developer and no 3rd party review is done by a distribution this means trusting a stranger’s account on a software forge.

    Update: the Debian infrastructure supports checking gpg signatures from upstream developers i.e. on the tarballs published on software forges.