4 ms·
If their GitHub account gets hacked, so do their customers. What's the fundamental difference?
by skrebbel 7y ago
If their GitHub account gets hacked, so do their customers. What's the fundamental difference?
- bildung 7y agoYou have the download at github and the checksum at you webserver. Same effort, but now attackers would have to have both services compromised to plant a malicious download.
- skrebbel 7y agoSo you refuse to download and install any executable unless it's served over https from one source and matches a checksum listed on a different source? And the argument here is that if you don't do that, you're shit at security?
- bildung 7y agoNo, I've said "Same effort, but now attackers would have to have both services compromised to plant a malicious download"