3 ms·
Somewhat misleading to claim that 'one user' would be all there is auditing software. It's not 'one user' that audits your Linux distribution. Can something be
by giantDinosaur 6y ago
Somewhat misleading to claim that 'one user' would be all there is auditing software. It's not 'one user' that audits your Linux distribution. Can something be snuck in that nobody notices into the source? Of course. But it's incredibly disingenuous to claim that because one user cannot audit all the software running on their machine that we should abandon the concept of auditable software in general and accept corporate lockdown. There's a massive difference between 'my operating system's code is open and many people have at least glanced at it' and 'this is a total secret beholden only to one corporate identity and nobody can have a look even if they had all the technical knowledge in the world'.
- tenuousemphasis 6y agoYou're missing the point. How do you verify that the bootloader or OS running on your hardware is the same as what the community verified? Hashes? How do you know the hash checking software is genuine without a TPM?
- dane-pgp 6y agoHow do you know the TPM is correctly validating the hash checking software unless you built the TPM firmware yourself?