3 ms·

Most HTTP libraries verify certificates by default. That's all you really need to do...

• WalterBright 8y ago
  Doesn't look like that stopped the router malware from installing itself.
  • all_blue_chucks 8y ago
    Citation that they have an auto-update that verifies certificates?
    • WalterBright 8y ago
      I have no idea. But obviously that simple solution is not so simple: 1. it is not trivial to produce 2. there could be vulnerabilities in the crypto implementation (like that never happens!) 3. there could be buffer overflow attacks that let the malware bypass the crypto 4. The server itself could be compromised into sending a correct certificate encoded malware 5. How are you going to audit all that? A physical switch, on the other hand, is much easier to audit, and an attacker would need physical control of device to compromise it.