5 ms·

Would you recommend a service other than email then? Which one?

nailer 11y ago
Signal (open whisper systems) is highly regarded and has verifiable source. People who know more about this: does Signal have verifiable builds too?
- nickpsecurity 11y ago
  None of them have verifiable builds. There are some doing reproducible builds with untrustworthy compilers. Verifiable builds are a larger problem they're ignoring because it's not a fad yet. Lots of prior work in CompSci and even industry on that, though. Links below on subversion and build-related stuff. My description of subversion-resistant build: https://news.ycombinator.com/item?id=10182282 https://news.ycombinator.com/item?id=10182282 Subversion-resistance in systems and builds in general: https://news.ycombinator.com/item?id=10478742 https://news.ycombinator.com/item?id=10478742
  - simoncion 11y ago
    > Verifiable builds are a larger problem they're ignoring because it's not a fad yet. Or because... oh, wait. You alluded to it yourself: > There are some doing reproducible builds with untrustworthy compilers. I expect that the bar required to verify (or design and build from scratch) a high-performance optimizing compiler [0] is substantially higher than the bar to rework your build system to give the same outputs for the same source code. [0] And -in the case of systems with VMs- a high-performance VM.
    - nickpsecurity 11y ago
      You mean coding the stuff people are doing in LLVM and GCC in ML on CompCert or similar system? No, it's significantly easier to do that than get current architectures right in C-like languages. FOSS just doesnt do it for most part. Rust was exception: did theirs in Ocaml. After FOSS compiler types build it, users can get the reproducible source and build the tool. Then that builds the other apps from source. See how easy that is? Note: Wirth et al built a safe language, simple ASM, CPU, OS, apps, and all with a few people in a few years. The ASM-3GL-Compiler build is WAY easier than you think. It bootstraps faster one after.
      - simoncion 11y ago
        > You mean coding the stuff people are doing in LLVM and GCC in ML on CompCert or similar system? No. I mean exactly what I said: > I expect that the bar required to verify (or design and build from scratch) a high-performance optimizing compiler (and -in the case of systems with VMs- a high-performance VM) is substantially higher than the bar to rework your build system to give the same outputs for the same source code. [0] Remember that this addressed your assertion that: > None of [the projects doing reproducible builds] have verifiable builds. ... Verifiable builds are a larger problem they're ignoring because it's not a fad yet. [1][2] If you can't see how my statement addresses the quoted claim, then more's the pity. [0] https://news.ycombinator.com/item?id=11363783 https://news.ycombinator.com/item?id=11363783 [1] https://news.ycombinator.com/item?id=11362470 https://news.ycombinator.com/item?id=11362470 [2] Italics added for emphasis.
        nickpsecurity 11y ago
        I may see what you're saying now. The problem is that this problem isnt solved in a vacuum: it's pre-requisites for security plus what SCM adds. They want to be sure the binary does what it's supposed to. That requires the What and How of source to be correct with no malicious modifications during development, storage, compilation, and distribution. That's a large problem. The compiler part is smaller with lots of work in CompSci, FOSS, and private sector (eg books). There's tools with source available on net for imperative and functional languages that are safer, too. Ignored almost entirely by safety or security oriented projects in compilers and general FOSS in favor of harder-to-analyze, less secure stuff. However, they'll happily bring up fad-driven stuff like Thompson attack or reproducible builds as The Solution. Here's the actual solution. You start with a simple, non-optimizing toolchain designed and documented for easy understanding and implementation. It has extensive test suite. User worried about subversion implements that in tooling of their choice on own machine. Wirth simplified it with P-code interpreter that was easy to inplement with compiler and apps targeting it. Once first compiler is done, it compiles the HLL source of its own code. Now, you can use it to compile a high-performance compiler's source or add optimizations to it. Most of this work is done so it's a natter of FOSS compiler types or project teams just integrating and using it. They won't, though, because proven practices and components for secure, software engineering are rarely use. They do popular stuff instead which screws them up in other ways. At least the malicious or buggy source from the potentially subverted server run throigh a black box with similar issues has identical binary coming out. Take that NSA! ;)
falcolas 11y ago
One interesting, if old, idea is to submit to an anonymous newsgroup where all messages are encrypted. You only see messages encrypted to you, and there's remarkably little metadata, so long as there is regular traffic from multiple sources.
- toyg 11y ago
  What about replacing the newsgroup with a blockchain? <ducks> (before anyone takes me seriously: this was a joke. Messaging must be ephemeral, anything else won't scale.)
  - falcolas 11y ago
    Not to mention that blockchain entries (at least for bitcoin) are anonymous but unique to each user. This adds metadata, and could allow an adversary to unravel your connections.
- jdfellow 11y ago
  Sounds not much different from Bitmessage.

Signal (open whisper systems) is highly regarded and has verifiable source. People who know more about this: does Signal have verifiable builds too?

nickpsecurity 11y ago
None of them have verifiable builds. There are some doing reproducible builds with untrustworthy compilers. Verifiable builds are a larger problem they're ignoring because it's not a fad yet. Lots of prior work in CompSci and even industry on that, though. Links below on subversion and build-related stuff. My description of subversion-resistant build: https://news.ycombinator.com/item?id=10182282 https://news.ycombinator.com/item?id=10182282 Subversion-resistance in systems and builds in general: https://news.ycombinator.com/item?id=10478742 https://news.ycombinator.com/item?id=10478742
- simoncion 11y ago
  > Verifiable builds are a larger problem they're ignoring because it's not a fad yet. Or because... oh, wait. You alluded to it yourself: > There are some doing reproducible builds with untrustworthy compilers. I expect that the bar required to verify (or design and build from scratch) a high-performance optimizing compiler [0] is substantially higher than the bar to rework your build system to give the same outputs for the same source code. [0] And -in the case of systems with VMs- a high-performance VM.
  - nickpsecurity 11y ago
    You mean coding the stuff people are doing in LLVM and GCC in ML on CompCert or similar system? No, it's significantly easier to do that than get current architectures right in C-like languages. FOSS just doesnt do it for most part. Rust was exception: did theirs in Ocaml. After FOSS compiler types build it, users can get the reproducible source and build the tool. Then that builds the other apps from source. See how easy that is? Note: Wirth et al built a safe language, simple ASM, CPU, OS, apps, and all with a few people in a few years. The ASM-3GL-Compiler build is WAY easier than you think. It bootstraps faster one after.
    - simoncion 11y ago
      > You mean coding the stuff people are doing in LLVM and GCC in ML on CompCert or similar system? No. I mean exactly what I said: > I expect that the bar required to verify (or design and build from scratch) a high-performance optimizing compiler (and -in the case of systems with VMs- a high-performance VM) is substantially higher than the bar to rework your build system to give the same outputs for the same source code. [0] Remember that this addressed your assertion that: > None of [the projects doing reproducible builds] have verifiable builds. ... Verifiable builds are a larger problem they're ignoring because it's not a fad yet. [1][2] If you can't see how my statement addresses the quoted claim, then more's the pity. [0] https://news.ycombinator.com/item?id=11363783 https://news.ycombinator.com/item?id=11363783 [1] https://news.ycombinator.com/item?id=11362470 https://news.ycombinator.com/item?id=11362470 [2] Italics added for emphasis.
      - nickpsecurity 11y ago
        I may see what you're saying now. The problem is that this problem isnt solved in a vacuum: it's pre-requisites for security plus what SCM adds. They want to be sure the binary does what it's supposed to. That requires the What and How of source to be correct with no malicious modifications during development, storage, compilation, and distribution. That's a large problem. The compiler part is smaller with lots of work in CompSci, FOSS, and private sector (eg books). There's tools with source available on net for imperative and functional languages that are safer, too. Ignored almost entirely by safety or security oriented projects in compilers and general FOSS in favor of harder-to-analyze, less secure stuff. However, they'll happily bring up fad-driven stuff like Thompson attack or reproducible builds as The Solution. Here's the actual solution. You start with a simple, non-optimizing toolchain designed and documented for easy understanding and implementation. It has extensive test suite. User worried about subversion implements that in tooling of their choice on own machine. Wirth simplified it with P-code interpreter that was easy to inplement with compiler and apps targeting it. Once first compiler is done, it compiles the HLL source of its own code. Now, you can use it to compile a high-performance compiler's source or add optimizations to it. Most of this work is done so it's a natter of FOSS compiler types or project teams just integrating and using it. They won't, though, because proven practices and components for secure, software engineering are rarely use. They do popular stuff instead which screws them up in other ways. At least the malicious or buggy source from the potentially subverted server run throigh a black box with similar issues has identical binary coming out. Take that NSA! ;)

falcolas 11y ago

One interesting, if old, idea is to submit to an anonymous newsgroup where all messages are encrypted. You only see messages encrypted to you, and there's remarkably little metadata, so long as there is regular traffic from multiple sources.

toyg 11y ago
What about replacing the newsgroup with a blockchain? <ducks> (before anyone takes me seriously: this was a joke. Messaging must be ephemeral, anything else won't scale.)
- falcolas 11y ago
  Not to mention that blockchain entries (at least for bitcoin) are anonymous but unique to each user. This adds metadata, and could allow an adversary to unravel your connections.
jdfellow 11y ago
Sounds not much different from Bitmessage.