3 ms·

There was previously a discussion of related issues here: https://news.ycombinator.com/item?id=6650987 https://news.ycombinator.com/item?id=6650987 At the end

by theoh 11y ago

There was previously a discussion of related issues here: https://news.ycombinator.com/item?id=6650987 https://news.ycombinator.com/item?id=6650987 At the end of the day you've got to trust someone even if you download a signed archive of source code. You can't audit every line.

comex 11y ago
You have to trust someone. You don't have to trust whoever is currently MitMing your Internet connection because the authors didn't bother to add HTTPS support.