Don’t trust, verify

Software and digital security should rely on verification, rather than trust. I want to strongly encourage more users and consumers of software to verify curl. And ideally require that you could do at least this level of verification of other software components in your dependency chains. Attacks are omnipresent With every source code commit and … Continue reading Don’t trust, verify →

daniel.haxx.se

@bagder This is a great list for projects to adopt, my only addition would be (not applicable to curl) projects downloading dependencies at build time (either CI, or locally).

It has become scarily common with during runtime *cough VS code*