3 ms·
> This means that downloading and running the binary is suddenly a very obscure use case. It should be for you, too. A rare use case for you, but definitely no
by mdwrigh2 13y ago
> This means that downloading and running the binary is suddenly a very obscure use case. It should be for you, too.
A rare use case for you, but definitely not an obscure one in general. Besides, trusting the author, in this case, only matters if you're willing to audit the source to verify that nothing malicious is occurring -- something I'm not going to do in general. I mean, realistically, when was the last time you audited your network drivers? your OS? your browser?
- rlpb 13y agoYou don't have to verify the source yourself. Others can do it. I trust the Debian maintainer for my package. He's a real world person who has had his key signed by other Debian developers. The fact that the source can be verified also reduces the risk of malicious modification. It's not necessarily just the author who might be malicious, either. The author's computer where he runs his compiler might be compromised.