3 ms·
You're skipping over the part about users having to recheck what you serve them every request to see you haven't added a backdoor. Not sure how much security pe
by iudqnolq 7y ago
You're skipping over the part about users having to recheck what you serve them every request to see you haven't added a backdoor. Not sure how much security people being able to look at and pin versions with traditional software they build adds, but probably nonzero.
- s_tec 7y agoRight, and the only solution is to audit and compile all the code running on your computer, including firmware. Otherwise, you have no idea what your computer is really running. In the real world, most people run pre-built software, which is worse than this ideal. I agree that browser Javascript is worse still, but it's still better than sending secrets to a centralized server somewhere. Security is a spectrum, not a binary on/off thing like this article tries to paint it. Things can still be helpful, even if they aren't perfect.
- iudqnolq 7y agoI agree completely. I didn't intend to say you were wrong, just that you didn't mention an important consideration.