Hacker News new | ask | show | jobs
by em-bee 1187 days ago
there is 0 guarantees that the binary I install on my system is the exact same binary as I would get if I build the source myself

not true, for years there are efforts in various distributions to make package builds reproducible. there are ways to build a package from source that allows you to get the same results and verify it.

we outsource this responsibility to the package maintainer

which is the point. i trust the package maintainers to do a better job at that than myself.