4 ms·

Updating is fine as long as it's from a auditable repository with full source code history, and built by a third-party like a distro (or the build is reproducib

Updating is fine as long as it's from a auditable repository with full source code history, and built by a third-party like a distro (or the build is reproducible).

goodpoint 3y ago
A repository with history is not enough. It's easy to circumvent. You need software packages reviewed and signed by trusted parties - aka a traditional Linux distro.
skrebbel 3y ago
Who really reads the source code though?
- msla 3y ago
  The idea is that enough people do that if something bad happens, it makes the news, by which I mean Twitter/Mastodon/HN/LWN and so on.
  - EGreg 3y ago
    By which time we get this: https://qbix.com/blog https://qbix.com/blog