lamefun wrote: > Trisquel page is available over HTTPS, yet: > > The download itself is over plain HTTP, ie.
HTTPS can indeed be useful for verifying authenticity of a connection, but GnuPG is probably more appropriate for verifying authenticity of a file (and also more efficient). > GPG: > http(!)://cdimage.trisquel.info/trisquel-images/trisquel_7.0_amd64.iso.torrent.asc I agree with you on this point: the torrent and GnuPG signature would probably be best downloaded over HTTPS. Last time I checked, the Trisquel archive key wasn't signed by anyone which makes it difficult to use web of trust to verify the key. > Also, there are no instructions on how to use them. Shouldn't a > security-conscious free software distribution also try to teach > their users how to keep themselves secure? Yes, a wiki page would be a good idea. Andrew
