Do you verify every IP packet that is forwarded through your firewall? Or do you trust your firewall maintains a robust state table? You do use recursive DNS with strict signature verification? Do you read the headers (and DKIM signatures) in your email client before reading them or do you trust you mail server did DMARC, DKIM, SPF, rDNS, and IP verification?
Unless you're using your using using IPTables as your firewall with debug logging on, your own recursive DNS resolver with a verifying server in front of it, or for email using K9-Mail on mobile or RoundCube on desktop to your self hosted mail server, chances are you didn't do any of those.
Do I wish people did more verification, you bet I do. But we'd all defer that if we could, it's obnoxious for even the advanced linux user to do, and many of not most system-level applications don't even ship outside the distro's repo, so you couldn't verify if you wanted to. Not to mention still, few projects even sign there commits let alone sign their builds.
I say this as someone who's built my own cli installer tool to manage my own dependencies because this is such a big deal. But I'm regularly interacting with normies on this (colleagues and customers) and know that they'd rather trust me to do it for them.
franzap13d ago
