News for hackers. Stuff that matters.

A comment on A minimal blog engine written in Go, compatible with Ghost themes. Parent comment

Re:A minimal blog engine written in Go, compatible with Ghos... by nemothekid on Saturday April 25, 2015 @05:15PM (#9439589)
I don't see how thats any different from copying a .deb/.rpm/add-apt onto your server.

Having source code readily available didn't stop heartbleed.

[ Parent | on HN ]
Re:A minimal blog engine written in Go, compatible with Ghos... by jetpks on Saturday April 25, 2015 @06:11PM (#9439729)
If you're downloading random unsigned debs/rpms from the internet and installing them, then you're just as wrong as downloading/execing a binary.

If you're downloading rpms/debs, verifying the signatures, and you trust the signer, then you're probably fine. Those signature signing/checking mechanisms are already built into rpm/deb, which is why they're being argued for.

[ Parent | on HN ]