4 ms·
And re-check them after every update? And trust that Mozilla won't randomly distribute a backdoor to 1/n of users? The means you're suggesting aren't possible
by damnyou 9y ago
And re-check them after every update?
And trust that Mozilla won't randomly distribute a backdoor to 1/n of users?
The means you're suggesting aren't possible to implement for most people today. If you care about real-world impact I would recommend thinking of other strategies.
- cyphar 9y agoReproducible builds effectively solve this problem, by making it possible to actually verify that you got the same binary (from the same source) as everyone else. Not to mention that if you're on Linux, distributions build Firefox themselves and so attacks against users need to be far larger in scale for 1/n attacks.
- damnyou 9y agoThey're both important steps, but neither solves the problem. Most users don't verify the reproducibility of their builds and don't use Linux.
- cyphar 9y agoIt solves the problem for users that use Linux. If other operating systems cared about making software distribution sane, they could also use package managers. It's a shame that they don't. As for verifying reproducibility, if you're using a package manager then this verification is quite trivial (and can be done automatically). Solving the problem for proprietary operating systems that intentionally have horrific systems of managing the software on said operating system is harder due to an artificial, self-inflicted handicap. "Just" switching people to Linux is probably easier (hey, Google managed to get people to run Gentoo after all).
- damnyou 9y agoTo repeat myself, for real world impact the only metric that counts is how many actual people benefited, not how many people benefit in ideal circumstances. If your solution is to switch the entire world to Linux then you may want to figure out how to do that. Many have tried and failed before. Good luck.