3 ms·
That's a good idea. It's even in my distributed, subversion-resistant, SCM scheme from years ago. ;) As I told Wheeler, you can get extra benefits with reproduc
by nickpsecurity 10y ago
That's a good idea. It's even in my distributed, subversion-resistant, SCM scheme from years ago. ;) As I told Wheeler, you can get extra benefits with reproducible builds on top of what I recommend. I just encourage people solve the root problems first. He did too with his SCM security page but did this stuff for event high-assurnce security (esp SCM). That sadly was what happened.
- lmm 10y agoI don't know about "solving the root problems". There are a lot of things that need to be done to get us to secure software, and in many cases there are multiple "blockers". I consider a security effort valuable when it both a) provides some improvement today, even if a fairly trivial one and b) will be useful in the end state we're aiming for , and I think reproducible builds qualify.