>How do you know the person you are trusting isn't an NSA agent? //
You don't but the top node in your web has to be trusted by lots of other people, some ideally are able to confirm the code is kosher - you need a massive conspiracy to happen or to have put your trust in people who couldn't care less about putting their name to malicious software.
It's like if dang tells you something is an official HN policy you might trust it, but if that statement by dang is signed by other HN officials then you're going to be pretty certain that's true.
Kinda like a technical "social proof". If I know that Stallman, Torvalds, Wozniak are using a piece of software then I'm going to be pretty confident that it's been checked out as much as any piece of software. Yes they could _all_ be endorsing it because the NSA told them too.
You don't but the top node in your web has to be trusted by lots of other people, some ideally are able to confirm the code is kosher - you need a massive conspiracy to happen or to have put your trust in people who couldn't care less about putting their name to malicious software.
It's like if dang tells you something is an official HN policy you might trust it, but if that statement by dang is signed by other HN officials then you're going to be pretty certain that's true.
Kinda like a technical "social proof". If I know that Stallman, Torvalds, Wozniak are using a piece of software then I'm going to be pretty confident that it's been checked out as much as any piece of software. Yes they could _all_ be endorsing it because the NSA told them too.