News for hackers. Stuff that matters.

A comment on Starting in August, Google will require that they sign apps, not you. Parent comment

Re:Starting in August, Google will require that they sign ap... by sichtlinkair on Sunday May 16, 2021 @06:37PM (#27177713)
> At the end of the day you still need to trust the organization building your OS so they don't push a backdoor in your root installed package.

I am curious what are good solutions to this problem? Compile your OS (and any other software) from source?

[ Parent | on HN ]
Re:Starting in August, Google will require that they sign ap... by content_sesh on Sunday May 16, 2021 @06:45PM (#27177791)
Somewhere a Gentoo maintainer's ears are ringing, but they don't know why...
[ Parent | on HN ]
Re:Starting in August, Google will require that they sign ap... by ex_amazon_sde on Tuesday May 18, 2021 @05:30PM (#27201450)
A backdoor/bugdoor is much more likely to be in the source code. Compiling the code by yourself does not help.

You have to rely on a distribution that has a many-eyes review policy and has security conscious users.

[ Parent | on HN ]