4 ms·
How is this any different from just downloading a binary from their website and running it? Which people have been doing for ages?
by mehrdadn 7y ago
How is this any different from just downloading a binary from their website and running it? Which people have been doing for ages?
- cameronbrown 7y agoPlenty of installation scripts ask for root.
- theamk 7y ago... and this is a red flag which generally forces me to stop and check why if I download latest music editor, and it wants root, I will be very suspicious.
- Rapzid 7y agoIt's different because in a lot of cases there are more layers of security in place that haven't been discussed. For instance it would be typical in the past to sign the packages/software and publish the public key either to the site or somewhere else. Private keys used to sign the software would never touch the website infrastructure and would live on, typically, much more secure build or sign-only infrastructure. The public keys used to verify the software could also be delivered through a separate channel, signed by a trusted third party, and etc. With Trust on First Use(TOFU) you'd trust the key when you first obtain it and be notified if the key ever changed unexpectedly. I agree with the general point of this article. This is the weakest part of the arguments IMHO.