3 ms·
Why not just switch to using The Update Framework (TUF)[1]. It solves many, many, many attacks against updating systems and we really should be using it everywh
by cyphar 10y ago
Why not just switch to using The Update Framework (TUF)[1]. It solves many, many, many attacks against updating systems and we really should be using it everywhere.
[1]: https://theupdateframework.github.io/ https://theupdateframework.github.io/
- j_s 10y agoProbably because TUF is 100% Python, and KeePass is a .NET-based Windows app.
- cyphar 10y agoTUF is a specification (with a sample implementation in Python). There are Go implementations as well, for example.
- dogma1138 10y agoBecause they'll have to implement it in .Net which is not a small task. Even if there is an implementation in .Net it will have to be audited and even then you are at the mercy of who ever maintains it. Sucking in OSS libraries might sound easy and smart but it's a huge gamble unless it's a defacto standard in the industry or is being maintained by a giant corporation you might be stuck up the creek without a paddle as soon as the person maintaining it decides to drop it.