4 ms·

That goes for every software you install. The only solution is to not install any software. And then hope that the preinstalled software on your device is OK:

sarciszewski 12y ago
OR I could verify an asymmetric cryptographic signature based on a public key I already possess. As long as the private key is not stolen, an attacker who can breach the server cannot backdoor the software I'm downloading.
- facepalm 12y ago
  How do you get the public key? I've heard the ssl certificate system that ships with browsers is broken, too. Maybe it would be an improvement to create a small command line tool that ensures https connections and asks for a hash before running a script?
  - sarciszewski 12y ago
    Key management is out of scope for this discussion. Ideally, it's shipped with your OS. If your OS is insecure, you're already vulnerable.
    - facepalm 12y ago
      So you are a fan of the solution that you have to pay the OS provider a fee so that they certify your app? Sure, that's a possibility, but hardly conductive to the open web.
      - sarciszewski 12y ago
        Nope. Don't try to put words in my mouth, please. apt-get install php-composer is much better than curl https://getcomposer.org/installer https://getcomposer.org/installer | php
        facepalm 12y ago
        How do you get your app into the repository? Maybe for Linux you don't need to pay, but you still need to gain approval of the maintainers. Might be even more costly than simply paying up (as for Apple or Microsoft).
        sarciszewski 12y ago
        Or you can set up a PPA. :/
        facepalm 12y ago
        But then you are back to square one - how do you establish the trustworthiness of the PPA?
        sarciszewski 12y ago
        TOFU. Done.
- tomp 12y ago
  Which is exactly the same as you verifying the public HTTPS key of the server you're downloading the software from; in reality, the only thing that differs is the server you're targeting (the compilation server, v.s. the downloading server).
  - sarciszewski 12y ago
    The difference is that the private key is on the server that handles HTTPS requests. If the server gets owned, they can change stuff arbitrarily. Having an offline PGP key makes attacks more expensive.
  - dllthomas 12y ago
    The downloading server is necessarily public facing, and the key is necessarily unlocked during operation. In a sense that's a difference in "the server you're targeting", but both are points in favor of pushing that to the compilation server.

sarciszewski 12y ago

OR I could verify an asymmetric cryptographic signature based on a public key I already possess. As long as the private key is not stolen, an attacker who can breach the server cannot backdoor the software I'm downloading.

facepalm 12y ago
How do you get the public key? I've heard the ssl certificate system that ships with browsers is broken, too. Maybe it would be an improvement to create a small command line tool that ensures https connections and asks for a hash before running a script?
- sarciszewski 12y ago
  Key management is out of scope for this discussion. Ideally, it's shipped with your OS. If your OS is insecure, you're already vulnerable.
  - facepalm 12y ago
    So you are a fan of the solution that you have to pay the OS provider a fee so that they certify your app? Sure, that's a possibility, but hardly conductive to the open web.
    - sarciszewski 12y ago
      Nope. Don't try to put words in my mouth, please. apt-get install php-composer is much better than curl https://getcomposer.org/installer https://getcomposer.org/installer | php
      - facepalm 12y ago
        How do you get your app into the repository? Maybe for Linux you don't need to pay, but you still need to gain approval of the maintainers. Might be even more costly than simply paying up (as for Apple or Microsoft).
        sarciszewski 12y ago
        Or you can set up a PPA. :/
        facepalm 12y ago
        But then you are back to square one - how do you establish the trustworthiness of the PPA?
        sarciszewski 12y ago
        TOFU. Done.
tomp 12y ago
Which is exactly the same as you verifying the public HTTPS key of the server you're downloading the software from; in reality, the only thing that differs is the server you're targeting (the compilation server, v.s. the downloading server).
- sarciszewski 12y ago
  The difference is that the private key is on the server that handles HTTPS requests. If the server gets owned, they can change stuff arbitrarily. Having an offline PGP key makes attacks more expensive.
- dllthomas 12y ago
  The downloading server is necessarily public facing, and the key is necessarily unlocked during operation. In a sense that's a difference in "the server you're targeting", but both are points in favor of pushing that to the compilation server.