4 ms·
Bytecode / binaries can be verified (for certain properties) using static analysis. Open source doesn't make verficiation that much easier (at scale), but it ma
by awinter-py 11y ago
Bytecode / binaries can be verified (for certain properties) using static analysis. Open source doesn't make verficiation that much easier (at scale), but it makes fixing a lot easier.
Also, until reproducible builds become commonplace, most linux users can't verify that their binaries come from a specific version of the source. Binary verification is the way to go.
- Grishnakh 11y agoYou only really need reproducible builds if you don't trust the source. So far, there hasn't been any evidence that any open-source projects are untrustworthy.
- awinter-py 11y agoDoveryai no proveryai -- trust but verify. Wasn't sourceforge bundling an adware installer for a while?
- anonbanker 11y agosome of us are using verified gcc builds in Gentoo, and building stage3 installs in order to handle the trust aspect.