Digital Utility Group
The mission of this group is to bring together utility professionals in the power industry who are in the thick of the digital utility transformation.
Shared Link
Digital signature flaws first reported on Energy Central now getting public attention
Energy Central has been discussing the risks and flawed beliefs with regard to digitally signed software packages. Now, public opinion is beginning to see these very issues, linked below, and are beginning to ask critical questions about the trustworthiness of digitally signed software. I believe these issues/flaws MUST be addressed in order to improve software supply chain security. Check out the on demand Energy Central Power Talk for insights into these issues.
Digital signature flaws first reported on Energy Central now getting public attention
The benefits and limitations of signing an open source package–using a private key to create a unique digital signature–are a surprisingly contentious topic. One of the maintainers associated with the Python Package Index maintainer has a cogent blog post called “Why Package Signing is not the Holy Grail.” This maintainer criticizes those who view signing packages as some sort of “voodoo” that creates “security.” Another open source software developer documented their frustrating experience discovering “how uninterested developers are in software authentication,” the technical name for signing and verifying packages. The developer even titled this piece “Nobody Cares about Signed Gems,” referring to the name used for Ruby packages.
Discussions
No discussions yet. Start a discussion below.
Get Published - Build a Following
The Energy Central Power Industry Network® is based on one core idea - power industry professionals helping each other and advancing the industry by sharing and learning from each other.
If you have an experience or insight to share or have learned something from a conference or seminar, your peers and colleagues on Energy Central want to hear about it. It's also easy to share a link to an article you've liked or an industry resource that you think would be helpful.
Sign in to Participate