sysutils/ipfs-go downloads pre-built binaries while sources are available

[Kurt Jaeger]

Hi!

> On 03/12/18 13:42, Adam Weinberger wrote:
> > While source is preferred over binary, we don???t delete ports just 
> > because they have binary blobs. 

> Binary downloads have an entirely different trust model. You have to 
> trust the producer of the binary, vs. with source code it is much more 
> obvious what does it do.

Even a modest amount of HTML mixed with JavaScript can be a deathtrap.

So what is source code again ?

> Neglect or misunderstanding of this difference 
> leads to rampant spread of malware on Windows and cell phones.

Yes, but the boundary can not be drawn at the 'source' border.
My fear is that we do not really understand where the border lies.

-- 
pi at opsec.eu            +49 171 3101372                         2 years to go !