<br><div class="gmail_quote"><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div class="Ih2E3d"><br>
</div>As I said in my previous email, Bitfrost clearly states (correctly, in<br>
my mind) that even justified belief that code originates from some known<br>
individual implies no trust relationship with that code. Period. Use<br>
isolation to make it safer to play with code and use signing to help<br>
reduce attackers' abilities to lie to you about what code you're going<br>
to be running.<br>
<div></div></blockquote><div><br>If you take this to the extreme, then you would reset manually-granted bitfrost privileges on every activity update, and even remove the default "resume" behavior from the journal for instances of that activity (if it is not the same code, it cannot be trusted to handle to handle the same data without an explicit "resume with new version" choice by the user).<br>
<br>I think new versions which are from the same source should get an implied trust level - the same trust as prior versions, which, in general, will be strictly limited by Bitfrost. I think that the fact that such "same source" may be the same corrupted source does not affect this.<br>
</div></div><br>