Skip to content

Comment on The Case of the Modified Binariesparent

Comments

Just like Mozilla's page, that makes perfect sense as long as the authenticity can be verified via other means, such as PGP signatures.

What use is having HTTPS to protect the very thing that you need to implement it. It's a basic chicken and egg problem, replayed every time OpenSSL gets compromised, and successfully circumvented by securing it with something else.

Think about it: there's an SSL break and you need to update OpenSSL. What good does it do you to have it available over SSL?

Because not all vulnerabilities are the same, and not all are total compromises. For example, BEAST was temporarily worked around by switching to use a stream cipher (RC4) instead of a block cipher. Everyone scrambled to update their OpenSSL version, then switched back, or they switched to an AEAD mode TLS 1.2.

Not that people shouldn't be using GPG, but only using it means you only protect the paranoid.

Tell that to building haskell from source. It depends on itself.

The first C++ compiler was written in C++:

http://www.stroustrup.com/bs_faq.html#bootstrapping

However, the first C compiler was not written in C, but in NB, an intermediate step from B to C:

http://stackoverflow.com/questions/18125490/how-was-the-firs...

I remember back in the day you used to be able to build gcc with various other compilers to bootstrap yourself. I think gcc now requires gcc features, so you're in the same boat.

But anyway, the comparison isn't very good because haskell/gcc don't develop sudden security vulnerabilities that instantly turn existing binaries unusable for getting new ones.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.