3 ms·

I'm certainly not equating safety to profits, but I think that a company such as Microsoft with decades of experience distributing cryptographically verified so

I'm certainly not equating safety to profits, but I think that a company such as Microsoft with decades of experience distributing cryptographically verified software to a range of demanding consumers (e.g. governments) and being big enough to be able to have teams running things like their certificate authority infrastructure, is much more likely to produce secure binary distributions than some GitHub Actions and shell scripts. I don't think your car analogy quite fits, as there are ongoing updates, and it's not like the end-user perception of regular VSCode, or backdoored VSCode, are going to be any different until someone spots the backdoor (and we can't rely on that).

yencabulator 3y ago
Meanwhile in the real world, Microsoft is actively screwing up, losing control of their signing keys, failing to implementing even basics of Azure authentication, destroying Azure customer VM security, and so on. https://news.ycombinator.com/item?id=37261500 https://news.ycombinator.com/item?id=37261500 https://news.ycombinator.com/item?id=28347141 https://news.ycombinator.com/item?id=28347141 https://news.ycombinator.com/item?id=28532531 https://news.ycombinator.com/item?id=28532531
fallat 3y ago
Seems your assumptions about their practices are wrong based on the other comment, but let's pretend that's the truth. Why would a GitHub Action be worse? You're just telling me it is, asking me to believe that... The car analogy is just that - you can break any analogy if you try. You've got a better one to help prove me right? :)