4 ms·
The difference is that it’s Open source, so you could certainly verify if you wanted to.
by alimov 4y ago
The difference is that it’s Open source, so you could certainly verify if you wanted to.
- alophawen 4y ago
- bisRepetita 4y agoYes, but the website owner can change its source code at any time, and even serve differently JS for each user, puting the entire responsibility on the user shoulder to check the code behavior all the time. It's not as demanding with an open source app with distributed source code and versioning. So I don't understand the snark, and how it is helpful.
- httpsterio 4y agoSame goes for open source builds, you have to either build it yourself or trust the supplied builds.
- SemanticStrengh 4y agoreproducible builds are a thing but yeah no easy solution out there for binary/code authenticity
- Hallucinaut 4y agoThose aren't really the only two options though, are they? If you don't trust software you can run it air-gapped or in an internet-free sandbox. Moreover good luck trying to verify that everything a website does on the server side is unchanged compared to a binary that's been built locally once.
- pabs3 4y agoIt is also possible to trust anyone who has verified the build is reproducible: https://reproducible-builds.org/ https://reproducible-builds.org/
- woojoo666 4y agoI wonder how often people are monitoring these things. If the photopea author decided to start collecting people's images, how soon would people catch on? And on the flip side, if the main Gimp author releases a binary that is different from the one built from source, how fast would people notice?
- justinclift 4y agoHmmm, "web tech" includes DRM stuff these days. So that's not 100% always true any more.
- alimov 4y agoDon’t know if you want to be checking it with every launch, but enjoy.
- mejutoco 4y agoIf this is the bar, disassembling the binary should work too for Photoshop or any other software.