trustchain-superapp VS gitian.sigs

Security needs work, functionality works. (disclaimer, I'm the responsibile professor)

[1] https://github.com/Tribler/trustchain-superapp#luxury-commun...

https://github.com/Tribler/trustchain-superapp/

This not my idea of democracy. I'd wish more people knew about Arrow's impossibilities theorem, especially privileged people into decentralisation.

Currently the only route is to: request permission from a Central Bank in Eurozone, download the Gateway code, and finally issue your own coins. (we got approval from our central bank)

Docs: https://github.com/Tribler/trustchain-superapp

Here's a bunch of developer gitian sigs on that build https://github.com/bitcoin-core/gitian.sigs/tree/master/0.21.1-win-unsigned The windows code signing thing is just a centralized process. My understanding is that the cert was revoked by accident by the provider when the devs asked to renew it. It's just a dumb process that doesn't mean a whole lot when it comes to what code you trust

The CA improperly revoked the certificate in response to a renewal request and back dated the revocation and are refusing to issue a new certificate (my understanding and that the CA now believes open source collaborations aren't eligible for code signing certs...)

The releases are still PGP signed by an official project key which has been in use for many years and is cross signed by many parties, as well as by another 16 parties that independent reproduced the binaries through the deterministic build process: https://github.com/bitcoin-core/gitian.sigs/tree/master/0.21...

By comparison, the windows code signing provides relatively little security assurance. Not too dissimilar from the HTTPS used on the download site. It, like the https, does have the advantage that it is widely checked while many users don't bother checking the actual release signatures.