Re:The new microcode from Intel and AMD adds three new features
by walterbell on Wednesday January 24, 2018 @08:38AM
(#16222502)
How does a user decide which third-party to trust for code verification?
E.g. do all/some “certified bodies” accept financial liability if their verification is later found to be incomplete? Since Spectre/Meltdown were not widely known, what happens if previously-certified code was exploiting this vulnerability?
Re:The new microcode from Intel and AMD adds three new features
by thomastjeffery on Wednesday January 24, 2018 @02:30PM
(#16225559)
I could act like Richard Stallman, and refuse to run any JavaScript. That doesn't sound very appealing, though. I would argue, however, that we need a culture shift away from JavaScript.
As far as verification goes, if authors use a GPG private key to sign their code, and distributors (package maintainers, etc.) do the same, they can be "verified" by the web of trust. That verification could also be hardened by a third party certificate body, although I'm personally wary of letting certificate authorities decide which code I can run on my computer.
Do you trust random JavaScript from the network? No? I didn't think so. So you trust RandomThirdParty verification?
Even banking code (ran on Secure Elements in credit cards) has levels of verification (by certified bodies) and trust (by banks and card processors). Where did you draw the line?