5 ms·

> In Tarsnap I might take this to an extreme — in addition to the aforementioned encryption, I encourage users to read the tarsnap source code rather than trust

> In Tarsnap I might take this to an extreme — in addition to the aforementioned encryption, I encourage users to read the tarsnap source code rather than trusting that I got everything right You still have to trust that what's running on your machine and on the servers is compiled directly from the source you have access to, right?

cperciva 10y ago
You don't need to trust the code on the server -- that's the point. You can compile the client code yourself. In fact, until recently you had to compile the client code yourself.
- leeoniya 10y ago
  ah yes, sorry. is there a trusted compilation service that uses a distributed agreement mechanism, à la blockchain or DHT for validating some git/svn hash against a binary. every downloadable source publishes its own binary hashes but the whole practice is somewhat moot in the event of server compromise, not to mention build reproducability.
  - beojan 10y ago
    You can compile the code yourself, then you would know the binary matches the source. Of course, you have to trust your compiler and OS, but with a service you would have to trust their compiler and OS.
- williamscales 10y ago
  Do you trust your compiler?
- koolba 10y ago
  Hey you guys provide binaries now? News to me! Was never an issue till now though.
  - cperciva 10y ago
    We're shipping binaries for Debian and derived platforms. Other platforms will follow.
- spb 10y ago
  Though, of course, this still means trusting the compiler: https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp...
  - cperciva 10y ago
    True, although if someone was going to put a backdoor into a compiler, they'd have to be idiots to attack tarsnap; much better to have it trojan an OS kernel or something else which is trusted and far more widely used.
Asooka 10y ago
If you build it yourself with the same compiler and options, and get the same bit-exact binary, then it's safe to assume the binary was built from those sources, since infiltrating the compiler team is not an easy job.

cperciva 10y ago

You don't need to trust the code on the server -- that's the point. You can compile the client code yourself. In fact, until recently you had to compile the client code yourself.

leeoniya 10y ago
ah yes, sorry. is there a trusted compilation service that uses a distributed agreement mechanism, à la blockchain or DHT for validating some git/svn hash against a binary. every downloadable source publishes its own binary hashes but the whole practice is somewhat moot in the event of server compromise, not to mention build reproducability.
- beojan 10y ago
  You can compile the code yourself, then you would know the binary matches the source. Of course, you have to trust your compiler and OS, but with a service you would have to trust their compiler and OS.
williamscales 10y ago
Do you trust your compiler?
koolba 10y ago
Hey you guys provide binaries now? News to me! Was never an issue till now though.
- cperciva 10y ago
  We're shipping binaries for Debian and derived platforms. Other platforms will follow.
spb 10y ago
Though, of course, this still means trusting the compiler: https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp...
- cperciva 10y ago
  True, although if someone was going to put a backdoor into a compiler, they'd have to be idiots to attack tarsnap; much better to have it trojan an OS kernel or something else which is trusted and far more widely used.

Asooka 10y ago

If you build it yourself with the same compiler and options, and get the same bit-exact binary, then it's safe to assume the binary was built from those sources, since infiltrating the compiler team is not an easy job.