this post was submitted on 05 Mar 2024
133 points (87.6% liked)
Open Source
29827 readers
457 users here now
All about open source! Feel free to ask questions, and share news, and interesting stuff!
Useful Links
- Open Source Initiative
- Free Software Foundation
- Electronic Frontier Foundation
- Software Freedom Conservancy
- It's FOSS
- Android FOSS Apps Megathread
Rules
- Posts must be relevant to the open source ideology
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
- !libre_culture@lemmy.ml
- !libre_software@lemmy.ml
- !libre_hardware@lemmy.ml
- !linux@lemmy.ml
- !technology@lemmy.ml
Community icon from opensource.org, but we are not affiliated with them.
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Trust is a thing. We should trust the person writing our dependencies and be able to verify that it was published by them, and not somebody in the middle maliciously altering the code.
You should not be installing unsigned binaries from a website. Either use a package manager that checks for signatures or manually check the signatures yourself. If the project doesn't sign their releases, open a bug report.