3 ms·
> Apologies for the snark, but I feel it's important to keep in mind in discussions of trust and security the enclosing scope or context. You can't trust the "i
by GhettoMaestro 7y ago
> Apologies for the snark, but I feel it's important to keep in mind in discussions of trust and security the enclosing scope or context. You can't trust the "integrity of the Linux source code" if you are checking it with compromised hardware, or running it on compromised hardware.
You are incorrect in this instance. The topic at hand is ensuring software integrity. Your scope of analysis is what I'll call "full-stack integrity" (hardware, firmware, software, etc).
- carapace 7y agoI'm pointing out that ensuring software integrity is a kind of toy or game in a world where the hardware is already "powned" by someone else. People aren't computing cryptographic checksums over the linux kernel by hand. The phrase "security theatre" is probably overused, but from my POV it would seem to apply here.
- GhettoMaestro 7y agoPoint it out all you want -- it is irrelevant to the discussion at hand. If said discussion was asserting integrity at a hardware level, you would have a point. But it doesn't do that. There is a reason it is narrowly prescriptive.