We live in an era of viruses, rootkits, botnets, ransomware, adware, spyware, and industrial sabotage. This is at the hands of script kiddies, political activi

We live in an era of viruses, rootkits, botnets, ransomware, adware, spyware, and industrial sabotage. This is at the hands of script kiddies, political activists, criminal networks, corporations, and every nation state with the budget for it - or some close approximation thereof, it seems. Sourceforge has been breached. Debian builds have been breached. Have you managed to dodge all of the above? I haven't. I've had accounts on at least 4 services which were breached at some point. I've seen viruses, adware, and spyware. I've seen script kiddies in my communities, distributing backdoored executables, gathering passwords, and getting banned. And this is only what has failed to escape my notice. It's not paranoia if they really are out to get you. > But, I wonder, is this something to worry about everywhere? Would it be useful for you to be able to detect when your build machine has been compromised, and starts producing malware laden executables? Reproducible builds are a tool that can potentially do that for you - just diff the binaries. Whether or not it's worthwhile to set up depends on how much of a pain in the ass making reproducible binaries is. Ongoing research into the subject is interesting, if only because it directly correlates to making it less of a pain in the ass when other people figure it out for you. > Is there a panic and an anxiety driving this trend, or are we just crossing dotting our i's and our crossing our t's with yet another set of best practices? I wouldn't describe such interest as panic or anxiety - but I wouldn't put it down to merely getting in line with "best practices" either. It's an interesting subject of research - and a potentially useful one at that.