[Debian] reproducible builds are a waste of time


-
reproducible builds are a waste of time
Yesterday I read an article on Motherboard about Debian’s plan to shut down 83% of the CIA with reproducible builds. Ostensibly this defends against an attack where the compiler is modified to insert backdoors in the packages it builds. Of course, the defense only works if only some of the compilers are backdoored. The article then goes off on a bit of a tangent about self propagating compiler backdoors, which may be theoretically possible, but also terribly, unworkably fragile.
I think the idea is that if I’m worried about the CIA tampering with Debian, I can rebuild everything myself from source. Because there’s no way the CIA would be able to insert a trojan in the source package. Then I check if what I’ve built matches what they built. If I were willing to do all that, I’m not sure why I need to check that the output is the same. I would always build from scratch, and ignore upstream entirely. I can do this today. I don’t actually need the builds to match to feel confident that my build is clean. Perhaps the idea is that a team of incorruptible volunteers will be building and checking for me, much like millions of eyeballs are carefully reviewing the source to all the software I run.
The original source document doesn’t actually mention deployment of the whacked SDK, just research into its development. Perhaps they use it, perhaps they rejected it as being too difficult and risky. Tricking a developer into using a whacked toolchain leaves detectable traces and it’s somewhat difficult to deny as an accident. If we assume that the CIA has access to developer’s machines, why not assume they have access to the bug database as well and are mining it for preexisting vulnerabilities to exploit? Easy, safe, deniable.
-
Debian Reproducible Builds to Detect Spyware
Debian has been getting a lot of attention the last couple of days for Jérémy Bobbio's work on Reproducible Builds. Bobbio has been working on this idea and implementation for a couple of years now, but after a presentation at Chaos Communication Camp last month it's come back into focus. In other Debian news, updates 8.2 and 7.9 were released.
-
Debian Linux versus the CIA
Hidden backdoors into software have long been a concern for some users as government spying has increased around the world. Now the Debian project has taken aim at the CIA and other government spy agencies with reproducible builds that aim to stop hidden backdoors.
-
- Login or register to post comments
Printer-friendly version
- 1367 reads
PDF version
More in Tux Machines
- Highlights
- Front Page
- Latest Headlines
- Archive
- Recent comments
- All-Time Popular Stories
- Hot Topics
- New Members
New GNU Releases and FSF Spring "Bulletin"
| pgAdmin 4 v6.11 Released
The pgAdmin Development Team is pleased to announce pgAdmin 4 version 6.11. This release of pgAdmin 4 includes 20 bug fixes and new features. For more details please see the release notes.
pgAdmin is the leading Open Source graphical management tool for PostgreSQL. For more information, please see the website.
|
today's leftovers
| today's howtos
|
Recent comments
2 hours 53 min ago
5 hours 34 min ago
5 hours 39 min ago
6 hours 12 min ago
11 hours 1 min ago
19 hours 37 min ago
20 hours 23 min ago
21 hours 2 min ago
1 day 2 hours ago
1 day 2 hours ago