4 ms·
The premise of the article is ignoring difference between "trust" and "trust but verify". And then there's a QA which answers criticism with "I absolutely disa
by pornel 6y ago
The premise of the article is ignoring difference between "trust" and "trust but verify".
And then there's a QA which answers criticism with "I absolutely disagree", "I think this is true, but".
> We know that attackers really do want to compromise build infrastructure, but more often they want to steal proprietary source code, which must pass through build servers.
This has shifted the goalposts so much they're on a different field now.
- ummonk 6y agoYes, exactly. And crucially you don’t need to verify yourself to get the benefits of verification. There is value in crowdsourced verification (i.e. I always have to choose a trusted vendor but it is safer when I know others might try building themselves and raise a fuss if there is a mismatch between their build and my vendor’s build).