undefined | Better HN

0 pointshashstring4mo ago0 comments

They can, but what does it solve? If a malicious package gets pushed, who or what is the equivalent of the CA that you are you going to nuke?

0 comments

rishabhaiover4mo ago

I was working with the assumption in this model the attestation is signed by ephemeral keys (OIDC) which would reveal the bad actor or give breadcrumbs. Enough to reduce incentives to hijack packages.

j / k navigate · click thread line to collapse

0 pointshashstring4mo ago0 comments

They can, but what does it solve? If a malicious package gets pushed, who or what is the equivalent of the CA that you are you going to nuke?

0 comments

rishabhaiover4mo ago

I was working with the assumption in this model the attestation is signed by ephemeral keys (OIDC) which would reveal the bad actor or give breadcrumbs. Enough to reduce incentives to hijack packages.

j / k navigate · click thread line to collapse