3 ms·
What about the distros that modify the package before giving it to you? I'm thinking of Debian's modification of openssl for example. https://www.debian.org/se
by barkingcat 7y ago
What about the distros that modify the package before giving it to you? I'm thinking of Debian's modification of openssl for example.
https://www.debian.org/security/2008/dsa-1571 https://www.debian.org/security/2008/dsa-1571
Just because it comes from a distro doesn't mean it's from the developer.
- falcolas 7y agoIt's still a trust issue. If I'm running a Debian based distribution, I trust Debian packages, and the content of those packages. It's a chain of trust that can't be provided by web servers and X509 certs.