• 1 Post
  • 12 Comments
Joined 1 年前
cake
Cake day: 2023年6月12日

help-circle




  • As far as I’m aware, there is no way to fully know there wasn’t any tampering or swapping of executables that were produced by a workflow. As most things on the internet, I believe there needs to be a degree of trust towards the original author and original owner of the repository that what they published is indeed a built executable from the original source. If there is any doubt about this, the only verifiable way to know for sure, if for a potential user to build from source themselves.

    I can think of ways where there is a trusted third party that provides a public key with which to sign the built executable, after which it can be checked by the third party (with its private key) whether it is still the same executable. Specially if a different key pair is used for every signing operation. But there are still flaws there, and would, ultimately, still rely on a degree of trust in the third party.








  • It’s an Apollo-only feature, Reddit doesn’t natively do this. I’ve been thinking about this feature for a bit, and it seems a straightforward implementation would be to store “seen” post identifiers with a TTL. Since the data is just bits of text, it should not take a lot of storage on device, and the TTL takes care of cleaning up. Since most posts on Reddit would be bumped away from any type of feed within at least a couple of days, a TTL of a week or shorter would probably work for Apollo. Not sure about Lemmy right now though. I’m not a mobile dev, so would not know exactly how to implement a system like this for Mlem, but if it was a webapp I would use Redis (if server-side) or something like local storage or cookies with TTLs (if bowser-based offline).