2 ms·
Yes, I also trust the original company more, for now. It would be nice to have more choices. Reproducible builds would help here, like Go did for their newest
by skybrian 3y ago
Yes, I also trust the original company more, for now. It would be nice to have more choices.
Reproducible builds would help here, like Go did for their newest SDK [1].
This would be particularly true for a fork when the source changes are fairly minimal, since you could just verify the patch.
Linux distros are fairly similar; why do we mostly trust Debian packages? Because there’s an umbrella organization and a process. That’s less true of a standalone organization.
Maybe eventually there will be an umbrella organization that just does reproducible builds, and people will use that to distribute binaries. (And independent verification could keep them honest, like happens with domain registrars.)
[1] https://go.dev/blog/rebuild https://go.dev/blog/rebuild
- haolez 3y agoGood point. That's one problem that might be well solved by something like BitTorrent, which hashes all the files as part of the protocol. Once a binary gets analyzed and trusted (the current binary, not the process or every new upgrade), it can be safely used.
- brnt 3y agoVscode packaging as/is famously not public. Plus, trust to do what exactly? Come with telemetry flipped on?
- skybrian 3y agoTrust is always relative to a threat model. I trust that the people who work on VS Code won't do all sorts of nefarious things that hackers might want to do if they can get code running on your system. I trust that their telemetry settings do what they say they'll do. And if someone finds a security bug, they'll fix it. I don't assume that there won't be security holes, but in effect, I'm assuming they probably won't affect me.