I had no idea this issue had been identified. While I find this tool very useful, the project is seeming rather questionable to me now.

  • refalo@programming.dev
    link
    fedilink
    arrow-up
    1
    ·
    2 months ago

    That is true, but also nobody is doing it. Just like nobody is verifying Signal’s “reproducible builds”.

    • Pup Biru@aussie.zone
      link
      fedilink
      English
      arrow-up
      1
      ·
      2 months ago

      are you sure?

      there could be thousands just waiting for a failure to come out and say “HEY THIS IS DODGY”