This sort of thing happens dragnet. And mullvad users are definitely a group to be targeted. Dont assume OP isnt a refugee or journalist and give them bad advice that could get them killed
That’s why you download the key from multiple distinct domains from multiple distinct locations using multiple distinct devices and veryify their fingerprints match. If the key/fingerprint is only available on one domain, open a bug report with the maintainer.
No, you’re confusing two vectors of attack. I’m saying that if you fan trust the vendor, then you’re still at risk from downloading malicious software that was manipulated between the vendor and you (man in the middle attack), unless you verified a signature using a key stores offline (note https is still vulnerable because the keys are stored online)
Of course it matters.We dont want to support or contribute content to a service that could go down one day and all the data is lost because we can’t fork it.
Homebrew is extremely insecure. It doesn’t verify package signatures, so its just as bad as the “just donloaf some sketchy untrusted binary off a website” approach
A year ago, China lifted draconian COVID restrictions that were an anvil around the neck of the economy and placed unprecedented controls on a society that, for the previous four decades, had grown accustomed to expanding personal freedoms, not shrinking them
Definitely not true for folks who use digital privacy tools