Hacker News Reader

Comment by alophawen | Hacker News Reader

Yes, but the website owner can change its source code at any time, and even serve differently JS for each user, puting the entire responsibility on the user shoulder to check the code behavior all the time.

It's not as demanding with an open source app with distributed source code and versioning.

So I don't understand the snark, and how it is helpful.

Same goes for open source builds, you have to either build it yourself or trust the supplied builds.

Those aren't really the only two options though, are they? If you don't trust software you can run it air-gapped or in an internet-free sandbox.

Moreover good luck trying to verify that everything a website does on the server side is unchanged compared to a binary that's been built locally once.

It is also possible to trust anyone who has verified the build is reproducible:

https://reproducible-builds.org/

reproducible builds are a thing but yeah no easy solution out there for binary/code authenticity

I wonder how often people are monitoring these things. If the photopea author decided to start collecting people's images, how soon would people catch on?

And on the flip side, if the main Gimp author releases a binary that is different from the one built from source, how fast would people notice?

Hmmm, "web tech" includes DRM stuff these days. So that's not 100% always true any more.

If this is the bar, disassembling the binary should work too for Photoshop or any other software.

Don’t know if you want to be checking it with every launch, but enjoy.

Reply on news.ycombinator.com