Who is “they”? The current OpenPGP keyserver does this, but again: that’s new, a... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		woodruffw on May 21, 2023 \| parent \| context \| favorite \| on: PGP signatures on PyPI: worse than useless Who is “they”? The current OpenPGP keyserver does this, but again: that’s new, and it’s a matter of policy, not protocol. PGP itself isn’t involved in that.

exabrial on May 21, 2023 [–]

Sonatype

woodruffw on May 21, 2023 | [–]

That’s good! But again: that’s not a property of PGP. It’s an operational burden that an unrelated (corporate?) entity has chosen to assume.

exabrial on May 21, 2023 | | [–]

Essentially. The decision was actually made by the maven central maintainers at the apache source foundation, and Sonatype implemented the decision.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact