8 ms·

I'm not really sure how to take this recent and emerging narrative that software source code compilation is actually an unreliable, unpredictable activity. I f

by tritium 11y ago

I'm not really sure how to take this recent and emerging narrative that software source code compilation is actually an unreliable, unpredictable activity. I find it really strange that there's a sudden, intense focus on the premise that, given the same source code, when providing it to different people in the wild and asking them to try and compile it, and then having them share their results, doing so reveals variations and disparities that are difficult to explain or account for. I know why people are suddenly paying attention to this detail: paranoia. I remember when I noticed this concept had first started to gain some traction. Once people started trying to compile certain open-source crypto applications, and found that their binaries weren't byte-for-byte replicas, it begged the question: Am I actually encrypting my confidential data with a surreptitiously hobbled program? Is there a covert plot to infiltrate and sabotage these sorts of software projects? How would I know if the encryption was weakened in a subtle way, when I don't have the resources to try and crack it at levels that demand well-funded hardware? But, I wonder, is this something to worry about everywhere? Is this why so many projects are now taking on this additional activity? Is there a panic and an anxiety driving this trend, or are we just crossing dotting our i's and our crossing our t's with yet another set of best practices?

MaulingMonkey 11y ago
We live in an era of viruses, rootkits, botnets, ransomware, adware, spyware, and industrial sabotage. This is at the hands of script kiddies, political activists, criminal networks, corporations, and every nation state with the budget for it - or some close approximation thereof, it seems. Sourceforge has been breached. Debian builds have been breached. Have you managed to dodge all of the above? I haven't. I've had accounts on at least 4 services which were breached at some point. I've seen viruses, adware, and spyware. I've seen script kiddies in my communities, distributing backdoored executables, gathering passwords, and getting banned. And this is only what has failed to escape my notice. It's not paranoia if they really are out to get you. > But, I wonder, is this something to worry about everywhere? Would it be useful for you to be able to detect when your build machine has been compromised, and starts producing malware laden executables? Reproducible builds are a tool that can potentially do that for you - just diff the binaries. Whether or not it's worthwhile to set up depends on how much of a pain in the ass making reproducible binaries is. Ongoing research into the subject is interesting, if only because it directly correlates to making it less of a pain in the ass when other people figure it out for you. > Is there a panic and an anxiety driving this trend, or are we just crossing dotting our i's and our crossing our t's with yet another set of best practices? I wouldn't describe such interest as panic or anxiety - but I wouldn't put it down to merely getting in line with "best practices" either. It's an interesting subject of research - and a potentially useful one at that.
mmozeiko 11y ago
See comment from Mike Stute here: https://www.quora.com/What-is-a-coders-worst-nightmare https://www.quora.com/What-is-a-coders-worst-nightmare

by tritium 11y ago

MaulingMonkey 11y ago

We live in an era of viruses, rootkits, botnets, ransomware, adware, spyware, and industrial sabotage. This is at the hands of script kiddies, political activists, criminal networks, corporations, and every nation state with the budget for it - or some close approximation thereof, it seems. Sourceforge has been breached. Debian builds have been breached. Have you managed to dodge all of the above? I haven't. I've had accounts on at least 4 services which were breached at some point. I've seen viruses, adware, and spyware. I've seen script kiddies in my communities, distributing backdoored executables, gathering passwords, and getting banned. And this is only what has failed to escape my notice. It's not paranoia if they really are out to get you. > But, I wonder, is this something to worry about everywhere? Would it be useful for you to be able to detect when your build machine has been compromised, and starts producing malware laden executables? Reproducible builds are a tool that can potentially do that for you - just diff the binaries. Whether or not it's worthwhile to set up depends on how much of a pain in the ass making reproducible binaries is. Ongoing research into the subject is interesting, if only because it directly correlates to making it less of a pain in the ass when other people figure it out for you. > Is there a panic and an anxiety driving this trend, or are we just crossing dotting our i's and our crossing our t's with yet another set of best practices? I wouldn't describe such interest as panic or anxiety - but I wouldn't put it down to merely getting in line with "best practices" either. It's an interesting subject of research - and a potentially useful one at that.

mmozeiko 11y ago

See comment from Mike Stute here: https://www.quora.com/What-is-a-coders-worst-nightmare https://www.quora.com/What-is-a-coders-worst-nightmare