Comment by stnikolauswagne
2 hours ago
Because its not realistic to do actual proper due diligence for this. Take the PHP fix from yesterday, I did not read the source of what they actually fixed, nor do i have the ability to understand it. I still installed it in my org because I have trust in the system that created it.
Its similar with apple, I have the reasonable assumption that whatever I install from the app store is not going to brick my phone, steal my data or be a giant resource hog that just runs in the background.
You trusted the PHP fix from the PHP devs because you trust PHP. That's my point. You didn't wait for Apple to bless it. It's not reasonable to consider Apple to be a universal arbiter of software.
But thats my point, I trust PHP in the same way that I trust the apple cert process. For the most part implicitly and by reputation.