19 ms·
This should lead to better checksum verification mechanism, because if you compromise the site, you can put whatever compromised checksum as well. I think havin
by tamimio 1y ago
This should lead to better checksum verification mechanism, because if you compromise the site, you can put whatever compromised checksum as well. I think having a centralized checksum verification system for all major (or all) distributions would be a good start.
- pona-a 1y agoWhy not even a PGP signature from the team? At least the public keys can be pinned so the possible compromise can be detected. I think Arch does something like that.