4 ms·
If you trust the signed source code there's no reason you shouldn't trust the signed binary - unless you have sufficient time and expertise to audit the source.
by svenfaw 8y ago
If you trust the signed source code there's no reason you shouldn't trust the signed binary - unless you have sufficient time and expertise to audit the source.
- mihaifm 8y agoThis is how I view it: * Being open source protects against a malicious developer. Otherwise there is nothing preventing him to build the binary with a different source, and send the passwords to his own server. * Signed code archive prevents against a compromised hosting site.
- perl4ever 8y agoIn order to get from a trusted source to a trusted binary, you have to trust the compiler and its dependencies as well, I think.