How do you trust a new Linux Distribution? Here is a dive into 5458 Keys coloring the groundlayer of trust the whole internet powers 💗

https://kron.fi/en/posts/stagex-web-of-trust/

Security celebrities have been shitting on the PGP Web Of Trust as an idea we should abandon in favor of centralizing trust on corpos.

Meanwhile the internet is filling with AI bots using fake corpo accounts and no one can tell who is human anymore. Huh.

WoT has never mattered more, and it is time we anchor modern tooling back to the human roots that built the internet.

My fellow [Stageˣ] maintainer Kron, Zoë Finja Emilia makes a strong visual case.

https://kron.fi/en/posts/stagex-web-of-trust/

Veritasium just dropped a video on ethics of the FOSS movement, right to repair, digital sovereignty, and the idea that closed source software has absolutely no role in supply chain security.

In recent years my teammates and I have shifted our entire careers to FOSS supply chain security engineering in spite of constantly being told our work is a waste of time. We feel seen!

https://yewtu.be/watch?v=aoag03mSuXQ

Shameless plugs @ https://caution.co https://distrust.co and https://stagex.tools

An insane amount of personal data is getting routed to proprietary LLM providers directly and indirectly.

Worse, all that personal data is going to get used to sit on the scales of otherwise "fair" weights to produce an entirely new form of toxic and manipulative targeted advertising.

Since we can't un-invent LLMs, the way forward is to make sure they exist with provable privacy and integrity.

We just released the first FOSS stack to do exactly that.

https://caution.co/blog/verifiable-llms.html

I should wait until this release is published next week, but I am too excited.

Stagex is the first production ready Linux distro to be:

- 100% deterministic
- 100% full source bootstrapped
- Maintainer signed on every commit and review
- Reproduced and signed by multiple maintainers on every artifact
- OCI container native
- LLVM/compiler-rt/libunwind native

https://codeberg.org/stagex/stagex/pulls/761

All the confs that turned us down and the people who said it could not be done can eat my entire ass.

The bare minimum for running security critical services is multi-party verified deterministic builds running on remotely attestable enclaves.

My teammates and I at Distrust have been helping teams architect and build this way for 5+ years now.

It was tough watching people repeatedly struggle to do everything from zero.

So we built the first 100% FOSS general purpose verifiable compute platform: Caution.

For prioritized early access join #caution-platform:matrix.org

https://caution.co