You said you don't "have an in-house build". So I guess you do now, then why can't you distribute that build? That doesn't require reproducible builds, and has the same security benefits.
-
-
how do you know the in house build server is ok?
1 reply 0 retweets 1 like -
how do you know anything isn't compromised? Are we going to discuss "reflections on trusting trust", or are we going to talk about reproducible builds?
2 replies 0 retweets 3 likes -
Replying to @taviso
I'd actually be interested if you're also disagreeing with David A. Wheelers thesis on countering trusting trust (especially sec. 4.6, 6, 8.8 & 8.9), which makes use of reproducible builds: https://dwheeler.com/trusting-trust/ It also considers compromise of build env other than the compiler.
1 reply 0 retweets 0 likes -
Replying to @jix_
The only claim i'm disagreeing with is that build reproducibility prevents backdoors. People are claiming that it can detect tainted output from *trusted* but compromised build infra, and they're correct. I'm saying that you can already do that today.
2 replies 0 retweets 1 like -
The play store? Android only right?
1 reply 0 retweets 0 likes -
I can't parse that tweet sorry.
1 reply 0 retweets 0 likes -
Responding to "People are claiming that it can detect tainted output from *trusted* but compromised build infra, and they're correct. I'm saying that you can already do that today." I saw "use the play store" as your response. Did I miss another solution of yours?
2 replies 0 retweets 0 likes -
I still don't follow, I didn't say "use the play store", where are you getting that from?
1 reply 0 retweets 0 likes -
Rich Salz Retweeted Tavis Ormandy
Rich Salz added,
Tavis OrmandyVerified account @tavisoReplying to @dEnergy_dTime @RichFelker and 8 othersHere is how to do it without reproducible builds: Matthew builds the binary he's audited, uploads it to the play store, then you download it. Works today, doesn't require any reproducible builds, doesn't require disabling updates. Done!1 reply 0 retweets 0 likes
Right, they're talking about some software distributed on the play store, and I'm explaining how to achieve the equivalent security of reproducible builds today without actually requiring anyone to implement complicated reproducible builds. What's the question about it?
-
-
I'm lost in the circles. Take care.
0 replies 0 retweets 0 likesThanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.