Post #2176680

@groved@mastodon.social @slink@fosstodon.org @0xKaishakunin@mastodon.social I also think we should celebrate any progress at all -- going from "yolo this tarball via http" to "https" doesn't solve everything but is still "better". Similarly going from unsigned binaries to signed via non-airgapped key is still "better" since Eve has to steal a key *and* compromise a binary. Certainly some risk of "false sense of security" there but ....