3 ms·
> But that said, any threat that looks like "but on the web you might send malicious code to user X" is also true of other app update mechanisms. Traditionally
by vertex-four 12y ago
> But that said, any threat that looks like "but on the web you might send malicious code to user X" is also true of other app update mechanisms.
Traditionally, app updates don't happen without the user's knowledge. I'm not entirely certain what the case is with the app stores. Point is, you can easily choose to stick to a specific version with, at least, most desktop applications. You only have to verify that one version.
- josephg 12y agoPractically speaking, what verification are you talking about? Who do you imagine is verifying the security of your application binaries? I'm confused by the argument that slower app update mechanisms lead to a more secure platform. The reverse is clearly true sometimes - when a vulnerability is discovered, updating an app quickly is important. When would low latency deploys lead to less secure code?
- vertex-four 12y ago> Practically speaking, what verification are you talking about? Who do you imagine is verifying the security of your application binaries? I can build it from source where any number of people may have verified it, or otherwise, I can trust the creator/packager/distributor now but not have to continue trusting them every time I access the app. > When would low latency deploys lead to less secure code? When any number of entities are either taken over by, decide to collaborate with, or become, an attacker at some point after you first download the application.