Signatures all the way down :( And reliable methods to verify those signatures without MITM attacks.

Yay someone agrees TPM's can be a good thing!

Right?

Some people do; mjg59 is working on boot attestation as an anti-boot-sector-virus mechanism. The underlying absolutely critical question is who controls the TPM hardware.

I absolutely feel that way personally, I just get frustrated by the common response from people on HN etc. TPM's are the most secure / most mature way to verify your software integrity.

Well, in my case knowing that I went to college with Simon, Richard et al, and could most likely arrange a face to face meeting / key exchange at the next Debian barbecue (hi Steve!) ... Of course, there are still plenty of things to be paranoid about (if I were the faceless security agency I know whose parties I'd have been going to 20 years ago)

It will take a combination of things.

Sandboxing applications would be a good start. That way you don't need to trust application developers.

But surely you must trust your SSH client, and thus its developers.

Right now it is pretty much a binary choice - trust and install. Don't trust and don't install. I trust the developer to have implemented the SSH protocol correctly -- I have to trust them that much. But I don't see why I should have trust them enough to give them full permissions to my machine. Sandboxing (with permissions) would allow the application to run and access a port, nothing else.

Write some new spec and prefix the name with "Web". Web stuff is awesome alright? That's the solution, so simple.

An official app store? If well-run, it could be a good answer.