[closewith]

No, it means a certain link exists on the website. On Hacker News of all sites, I would think we should all know that's not sufficient evidence of identity for an update regarding the source of critical software like a terminal.

[viraptor]

Nobody claimed it validates the identity in any way. It validates that the person at the other website confirms it's their social account and the social account matches the other direction. The real identity is not involved here in any way and never was. You're disagreeing with someone nobody here raises.

But the link validation confirms that if you believed that the original download site belongs to the author, then you would have almost the same guarantee about the social account. (+/- the chances of the putty website being hacked)

[closewith]

Yes, your caveat at the end there is exactly why this method shouldn't be trusted, as it's indistinguishable from an attacker with access to embed a single link.

So it doesn't confirm the account belongs to the author, it confirms the site has a specific link and nothing more.

[Ukv]

A regular link won't do, since it requires the rel="me" attribute, which is intended for this purpose: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/...

Adding a <meta> tag or creating a page with certain content are already used even for more impactful verification, like getting issued a certificate for that domain.

If an attacker does have broad access to edit the HTML of your website, I feel that's already the issue and Mastodon verifying that "this person controls this website" isn't even really wrong.

[closewith]

So you have read that page and understand its purpose is to link social media profiles for informational purposes, but don't understand that it's not suitable for any kind of auth, let alone in a software supply chain?

[Ukv]

By the XFN spec, it "demonstrates that the same person has control over [the pages]". The docs page I linked links to two further specs for using it for authentication in the way that Mastodon does.

[closewith]

I'm sorry. The XHTML Friends Network rel tag is neither reliable identification nor authentication. It's designed to say "this is my blog" in low stakes environments.

No sane sober person would use it to authenticate messages about changing URLs in a software supply chain.

[account42]

A meta tag won't get you a certificate, that's highly misleading.

[account42]

If A is saying "I'm also B" an B is saying "I'm also A" then you for most purposes you can trust that A and B are the same person, no?