> Yeah, but if you're blindly installing a third party's binary blob, it's hard to call that "zero trust". No, "zero trust" means you install it (or anything)

> Yeah, but if you're blindly installing a third party's binary blob, it's hard to call that "zero trust". No, "zero trust" means you install it (or anything) but assume that is is malicious so take proactive steps to limit its access within your network. "Zero Trust" means assuming everything (including your compiler) might be compromised, so try to limit the damage any one incident can cause.