4 ms·
A challenge: what would the best remedies to this situation be? Should we be pressuring OSes to come with PGP ware and other basic tools by default, for instanc
by msane 13y ago
A challenge: what would the best remedies to this situation be? Should we be pressuring OSes to come with PGP ware and other basic tools by default, for instance?
- FigBug 13y agoIt will take a combination of things. Sandboxing applications would be a good start. That way you don't need to trust application developers.
- acct 13y agoBut surely you must trust your SSH client, and thus its developers.
- FigBug 13y agoRight now it is pretty much a binary choice - trust and install. Don't trust and don't install. I trust the developer to have implemented the SSH protocol correctly -- I have to trust them that much. But I don't see why I should have trust them enough to give them full permissions to my machine. Sandboxing (with permissions) would allow the application to run and access a port, nothing else.
- toomuchtodo 13y agoSignatures all the way down :( And reliable methods to verify those signatures without MITM attacks.
- pilom 13y agoYay someone agrees TPM's can be a good thing! Right?
- pjc50 13y agoSome people do; mjg59 is working on boot attestation as an anti-boot-sector-virus mechanism. The underlying absolutely critical question is who controls the TPM hardware.
- pilom 13y agoI absolutely feel that way personally, I just get frustrated by the common response from people on HN etc. TPM's are the most secure / most mature way to verify your software integrity.
- jrabone 13y agoWell, in my case knowing that I went to college with Simon, Richard et al, and could most likely arrange a face to face meeting / key exchange at the next Debian barbecue (hi Steve!) ... Of course, there are still plenty of things to be paranoid about (if I were the faceless security agency I know whose parties I'd have been going to 20 years ago)
- rebelde 13y agoAn official app store? If well-run, it could be a good answer.
- clarry 13y agoWrite some new spec and prefix the name with "Web". Web stuff is awesome alright? That's the solution, so simple.