4 ms·

Why has this been downvoted? It's an important argument. Which open source projects have deterministic builds, with a verifiable source of signature informatio

by Swannie 11y ago

Why has this been downvoted? It's an important argument. Which open source projects have deterministic builds, with a verifiable source of signature information - be that concensus or a source of truth that is verfied by concensus, so that I can be sure that either a) the binary I download has a very high certainty of being correct, or b) the source code I downloaded and compiled from has a very high certainty of being un-modified. With a vendor, they don't need deterministic builds so badly, as they push a single file, and an authoritative source of signatures.

schoen 11y ago
Ultimately a vendor needs deterministic builds too. Otherwise, it doesn't necessarily know what it's shipping! I have an example of a binary where the difference between a remotely exploitable service and a fixed version of the same service is a single bit. That bit (or some other bit that also changes the code's functionality in an important way) can be changed by any person or (potentially compromised) computer in the chain of compilation, packaging, and distribution unless someone has a way to tell whether what those people and computers assert is "correct". If the binaries routinely change appreciably every time someone cuts a software release, it's going to be expensive to go back and check whether there's also a malicious change, bearing in mind that the person whose computer made the change doesn't have to have been malicious.
- roel_v 11y ago
  Sure, my point was that open source doesn't matter anything for this attack vector. I have yet to see anyone with reproducible builds being used and cared about in production. It's too expensive, and impractical. How are you going to verify that a system you just installed is OK? An attacker would've patched the md5sum (or other hashing) utility as well, so you'd need to mount you whole filesystem from another (trusted) machine, run the checksum on each file from that other machine, and compare with a known-good (through a reputation network) list. And in the mean time, a million monkeys have social-engineered your secretary's machine through a Farmville js trick and pwned your network 3 ways from Sunday.
  - schoen 11y ago
    I agree it would be hard to take advantage of today. I hope we'll get better tools over time, like package managers and forensics tools that are aware of these things.

by Swannie 11y ago

schoen 11y ago

Ultimately a vendor needs deterministic builds too. Otherwise, it doesn't necessarily know what it's shipping! I have an example of a binary where the difference between a remotely exploitable service and a fixed version of the same service is a single bit. That bit (or some other bit that also changes the code's functionality in an important way) can be changed by any person or (potentially compromised) computer in the chain of compilation, packaging, and distribution unless someone has a way to tell whether what those people and computers assert is "correct". If the binaries routinely change appreciably every time someone cuts a software release, it's going to be expensive to go back and check whether there's also a malicious change, bearing in mind that the person whose computer made the change doesn't have to have been malicious.

roel_v 11y ago
Sure, my point was that open source doesn't matter anything for this attack vector. I have yet to see anyone with reproducible builds being used and cared about in production. It's too expensive, and impractical. How are you going to verify that a system you just installed is OK? An attacker would've patched the md5sum (or other hashing) utility as well, so you'd need to mount you whole filesystem from another (trusted) machine, run the checksum on each file from that other machine, and compare with a known-good (through a reputation network) list. And in the mean time, a million monkeys have social-engineered your secretary's machine through a Farmville js trick and pwned your network 3 ways from Sunday.
- schoen 11y ago
  I agree it would be hard to take advantage of today. I hope we'll get better tools over time, like package managers and forensics tools that are aware of these things.