4 ms·
That just asserts that it's the same series of bytes that was originally provided. You still have to trust the provider.
by recursive 10y ago
That just asserts that it's the same series of bytes that was originally provided. You still have to trust the provider.
- njharman 10y agoRight, we know that security is a gradient, do you? There is a quantitative difference between covering your laptop under a coat and locking the car doors and leaving it on bench when you take a walk around park. Just as there is difference between piping the internet to root shell and installing a signed package that has whole ecosystem and many users validating and looking at it.
- deleted 10y ago[deleted]
- foota 10y agoIn fairness, ssl from a trusted host is pretty similar.
- na85 10y agoAt least you avoid javascript pastejacking in this manner.
- myhf 10y agoYou always have to trust the provider. If you don't authenticate the message you also have to trust every carrier.
- falcolas 10y agoYou're trusting the provider of the program, not the provider of the server. Curl/bash from github? You're trusting Github to provide the correct content; there have been times before where people have been able to spoof other users. Signatures on the package (or the code) would prevent an issue like this.