3 ms·
Yup, thought it was clear in my comment, the software producers should be building and signing THEIR copy from their machine. Seeing the same public hashes can
by hardwaresofton 3y ago
Yup, thought it was clear in my comment, the software producers should be building and signing THEIR copy from their machine.
Seeing the same public hashes can work just like people check shasums now, also possible to independently verify at any time
- woodruffw 3y ago> Seeing the same public hashes can work just like people check shasums now, also possible to independently verify at any time “Verify at any time” devolves to “verify never.” Verification needs to be mandatory to have any security value, which comes back the original point about operationalization.