4 ms·

Is Debian really built on private computers? How is this any more secure than a random PPA/EXE download from the internet?

yrro 10y ago
Source-only uploads have been supported for some time, but they are not yet mandatory. https://wiki.debian.org/SourceOnlyUpload https://wiki.debian.org/SourceOnlyUpload
dublinben 10y ago
What is the alternative? Public computers?
- dispose13432 10y ago
  Centralized computers of reputable projects are much more secure than private computers of individual developers
  - eeZah7Ux 10y ago
    That's what the Debian buildbots do, plus companies doing their own rebuild. Reproducible builds allow comparing the outputs: they'll have to be identical.
  - ryukafalz 10y ago
    The source ultimately comes from those developers' computers, though. Do you trust those computers not to tamper with the source? If you do, but you don't trust them not to tamper with the resulting binary - well, that's what reproducible builds are for. If you don't... you've got bigger problems than your build system.
  - angry-hacker 10y ago
    Who reads ALL the source code? If no one, then it doesn't matter where it's built.
dom0 10y ago
> Is Debian really built on private computers? "Depends". Package maintainers usually build the binary package for their arch themselves (typically x86_64 nowadays). The ~dozen other archs are built by buildd, which also largely runs on hardware* controlled by private people / entities as far as I'm aware. See eg. https://db.debian.org/machines.cgi https://db.debian.org/machines.cgi * you can really forget building software on emulators. Way too slow.
- nickpsecurity 10y ago
  What about FPGA-based emulators for building older architectures? Anyone trying that?
  - dom0 10y ago
    While there are a bunch of older archs most are quite well and alive (hence supported by Debian). For example, there are a bunch of POWER8 machines in buildd, or some fairly recent SPARC machines. Some of these machines are donated. FPGA emulation would be a huge project, both time/involvement wise and also cost-wise (FPGAs are freakin' expensive). Software emulation gets nowhere near usable performance, even with older archs (say PowerPC970) the real, >10 year old hardware is much much faster than any emulation, which also tend to be rather limited. For example, PPC in QEMU is actually not the 970 (G5), but an G3ish thing. Conversely, the virtual machine is limited to 1.5 GB of RAM (iirc). Technically you can build stuff on that. It just takes ages. 2-10 minutes for compiling a C module. The real deal (a G5 in the cellar) on the other hand can be stuffed with RAM to 8-16 GB and will be about as fast as a slow laptop nowadays is. (Except it will make much more heat and will be louder. Well, the latter depends on the laptop, hellish noises they make...).
    - nickpsecurity 10y ago
      Makes sense. Thanks for the detailed response.

yrro 10y ago

Source-only uploads have been supported for some time, but they are not yet mandatory. https://wiki.debian.org/SourceOnlyUpload https://wiki.debian.org/SourceOnlyUpload

dublinben 10y ago

What is the alternative? Public computers?

dispose13432 10y ago
Centralized computers of reputable projects are much more secure than private computers of individual developers
- eeZah7Ux 10y ago
  That's what the Debian buildbots do, plus companies doing their own rebuild. Reproducible builds allow comparing the outputs: they'll have to be identical.
- ryukafalz 10y ago
  The source ultimately comes from those developers' computers, though. Do you trust those computers not to tamper with the source? If you do, but you don't trust them not to tamper with the resulting binary - well, that's what reproducible builds are for. If you don't... you've got bigger problems than your build system.
- angry-hacker 10y ago
  Who reads ALL the source code? If no one, then it doesn't matter where it's built.

dom0 10y ago

> Is Debian really built on private computers? "Depends". Package maintainers usually build the binary package for their arch themselves (typically x86_64 nowadays). The ~dozen other archs are built by buildd, which also largely runs on hardware* controlled by private people / entities as far as I'm aware. See eg. https://db.debian.org/machines.cgi https://db.debian.org/machines.cgi * you can really forget building software on emulators. Way too slow.

nickpsecurity 10y ago
What about FPGA-based emulators for building older architectures? Anyone trying that?
- dom0 10y ago
  While there are a bunch of older archs most are quite well and alive (hence supported by Debian). For example, there are a bunch of POWER8 machines in buildd, or some fairly recent SPARC machines. Some of these machines are donated. FPGA emulation would be a huge project, both time/involvement wise and also cost-wise (FPGAs are freakin' expensive). Software emulation gets nowhere near usable performance, even with older archs (say PowerPC970) the real, >10 year old hardware is much much faster than any emulation, which also tend to be rather limited. For example, PPC in QEMU is actually not the 970 (G5), but an G3ish thing. Conversely, the virtual machine is limited to 1.5 GB of RAM (iirc). Technically you can build stuff on that. It just takes ages. 2-10 minutes for compiling a C module. The real deal (a G5 in the cellar) on the other hand can be stuffed with RAM to 8-16 GB and will be about as fast as a slow laptop nowadays is. (Except it will make much more heat and will be louder. Well, the latter depends on the laptop, hellish noises they make...).
  - nickpsecurity 10y ago
    Makes sense. Thanks for the detailed response.