So basically reproducible builds with a dependency list and the CVE list could provide more certainty about the tools we use?
What about websites though? Hash-summed files aren't going to save us, because resources can be loaded dynamically and the client can't know the hash before retrieval.
Reproducible builds would be a great first start. Forcing governments to use opensource may be another step.
What about websites though? Hash-summed files aren't going to save us, because resources can be loaded dynamically and the client can't know the hash before retrieval.
Reproducible builds would be a great first start. Forcing governments to use opensource may be another step.