3 ms·

That's why I prefer distro-built packages over upstream binaries wherever possible. It greatly reduces the number of build and distribution platforms that I hav

• lxgr 3y ago
  With reproducible builds (and as long as the distribution doesn't need to maintain any patches vs. upstream), this could even provide the best of both worlds: Verifiable hashes (comparable with upstream and other distributions) and a smaller set of trusted entities. On the other hand, I'm not sure I'd necessarily trust a small open-source distribution's maintainers more than a widely used password manager's developers; I think I'd prefer my root of trust to be whatever has more users (and by proxy, hopefully scrutiny).
• SAI_Peregrinus 3y ago
  Or source-based distros (and equivalently source-based distros with reproducible builds & a binary cache of build artifacts with a package manager that checks the resulting hash matches the expected value). Of course source can still be compromised, say by malicious dependencies. But it's better than source and binaries being compromisable.