4 ms·

Why not just use openpgp signing instead like most GNU/Linux distros?

• skybrian 10y ago
  Signing a binary allows the updater to verify that it came from a trusted source, but it doesn't tell you whether they gave you the same binary as everyone else, or a custom one. Binary transparency ensures that there's a complete, public list of all updates sent out. It's an additional level of verification showing that the source isn't up to any shenanigans. It's more of a deterrent though. It doesn't prevent sending a custom update; it just makes it difficult to hide.
• dane-pgp 10y ago
  I think that a threat model that Binary Transparency tries to counter is one where an attacker gets hold of the signing key, or coerces the holder of that key, to sign a malicious update which is then sent to a targeted victim (on a compromised mirror site, for example). If people are combining Reproducible Builds with Binary Transparency, then the attacker probably has to release the same binary to everyone, and release the source code containing the malicious change. It remains to be seen whether enough people would audit the source code diffs of each release of Firefox, say, to stop a malicious update from affecting a large number of users. In particular, mechanisms would need to be put in place to stop users updating to a release which was discovered (or reported and then verified) to be compromised.