Slashdot Mirror

Not everyone can scour the source/binary of every app they get from a 'trusted' site.

At least someone inspected this package. The malware was found, after all. Besides, expecting everyone to scour everything is a Red Herring.

And if you cant trust the 'trusted' sites for the free stuff, then the entire FreeOS movement is dead in its tracks.

At some point you have to trust. Not 'click yes on pop-up warning number 300 for the day' trust but 'these packages are signed by so-and-so who I trust.' Or to put it in words that the corporate world uses: 'signed by so-and-so who I blame.'

A bigger white elephant in the room is Unix-style OSes that do a good job of securing the OS from damage by users, but still let the user completely wipe their own home directory out. I don't really care that this screensaver I download and put in ~/whereever can't mess with anything else in the system. All it has to do is ruin ~/. As they say, that's where I keep my stuff.

And regardless, can you trust the build based on that source code? ACM Classic: Reflections on Trusting Trust (about the need for a bootstrap compiler, and the concern that this compiler might be infiltrated.)

For a good example see this article: "Reflections on Trusting Trust"

Broken link. Try this: Reflections on Trusting Trust. It's the most frightening security paper of the last 30 years.

We didn' reflash those routers with Linux just for fun, we have a clear goal: having a cheap and reliable wireless node for use within a mesh network , a footprint small enough so you can easily put it on a building roof and hardware that does not consume a lot of power so you can power it from small batteries or solar cells. Good luck doing the same thing with classical desktop hardware !!

We also want to use a dynamic routing protocol such as AODV or ZRP and make those things IPv6 ready.

If you can find a router with such things in the firmware, tell me.

--