4 ms·

If reproducible builds are not used for these projects, it is not easily possible to verify whether end user distributed binaries are equal to the available sou

If reproducible builds are not used for these projects, it is not easily possible to verify whether end user distributed binaries are equal to the available source code. Never mind that in many cases actually replacing the SSL component may not be possible.

jessaustin 9y ago
Sure, but that amounts to a criticism of particular devices or clients that can't be verified. If it was meant as a criticism of this repo, the answer is still "PR and fork".
nbsd4life 9y ago
it's rust code, you can't even compile it without downloading a binary from the internet.
- steveklabnik 9y ago
  mrustc successfully bootstrapped the compiler; you could compile this with nothing but a C compiler and some elbow grease if you truly desired.
  - nbsd4life 9y ago
    mrustc is stuck at 1.19.0
    - steveklabnik 9y ago
      That doesn't matter for the purposes of bootstrapping; it's broken the chain. 1.19 -> 1.25 is much, much, much easier than the thousand-odd builds you'd need to bootstrap from the OCaml implementation. This is why I mentioned "elbow grease." It's not trivial, but if it's something you're concerned about, it is possible.
      - nbsd4life 9y ago
        been in this movie before with ocaml for bootstrap. it will die
      - nbsd4life 9y ago
        sorry for being ranty on HN, I'm abusing my anonymity to vent. please support a bootstrap method. I can't use any project in a programming languages that require downloading a specific binary to use in certain setups. It's not a hyperbole to bash rust, we're crazy people who make sure our projects can be bootstrapped like so. I was very interested in mrustc. but it's going to die very quickly when every version bump is an extra rust (it took me 9 hours to build rust at some point). Having to give up projects because they threaten to use rust is painful. It's a good language and someone went out of their way to fix the bootstrap problem. please give him a hand.
        steveklabnik 9y ago
        Every project has to pick what problems matter, and can be addressed with the current resources at hand. People, time, servers, whatever. At this time, there's just not enough people that care at this degree of paranoia; all of the Linux distros are fine with this, even Tor is fine with this. I can appreciate that something like this would be more convenient, but that's a teeny, tiny group of people this would serve, and it would be so, so, so much effort to put in. It just doesn't make sense. (Given that you're anonymous, I don't know who exactly you're asking for here.) > but it's going to die very quickly when every version bump is an extra rust It doesn't need to live; by existing it's already broken the boostrap chain.

jessaustin 9y ago

Sure, but that amounts to a criticism of particular devices or clients that can't be verified. If it was meant as a criticism of this repo, the answer is still "PR and fork".

nbsd4life 9y ago

it's rust code, you can't even compile it without downloading a binary from the internet.

steveklabnik 9y ago
mrustc successfully bootstrapped the compiler; you could compile this with nothing but a C compiler and some elbow grease if you truly desired.
- nbsd4life 9y ago
  mrustc is stuck at 1.19.0
  - steveklabnik 9y ago
    That doesn't matter for the purposes of bootstrapping; it's broken the chain. 1.19 -> 1.25 is much, much, much easier than the thousand-odd builds you'd need to bootstrap from the OCaml implementation. This is why I mentioned "elbow grease." It's not trivial, but if it's something you're concerned about, it is possible.
    - nbsd4life 9y ago
      been in this movie before with ocaml for bootstrap. it will die
    - nbsd4life 9y ago
      sorry for being ranty on HN, I'm abusing my anonymity to vent. please support a bootstrap method. I can't use any project in a programming languages that require downloading a specific binary to use in certain setups. It's not a hyperbole to bash rust, we're crazy people who make sure our projects can be bootstrapped like so. I was very interested in mrustc. but it's going to die very quickly when every version bump is an extra rust (it took me 9 hours to build rust at some point). Having to give up projects because they threaten to use rust is painful. It's a good language and someone went out of their way to fix the bootstrap problem. please give him a hand.
      - steveklabnik 9y ago
        Every project has to pick what problems matter, and can be addressed with the current resources at hand. People, time, servers, whatever. At this time, there's just not enough people that care at this degree of paranoia; all of the Linux distros are fine with this, even Tor is fine with this. I can appreciate that something like this would be more convenient, but that's a teeny, tiny group of people this would serve, and it would be so, so, so much effort to put in. It just doesn't make sense. (Given that you're anonymous, I don't know who exactly you're asking for here.) > but it's going to die very quickly when every version bump is an extra rust It doesn't need to live; by existing it's already broken the boostrap chain.