4 ms·

I think it would be quite the day to take the hashes of Microsoft's ISO images for Windows, and compare it with the source code to check if there is government

I think it would be quite the day to take the hashes of Microsoft's ISO images for Windows, and compare it with the source code to check if there is government backdoors in the code.

leeoniya 8y ago
you can't even do that with their open source VSCode, since they add in branding/telemetry/licensing to the actual binaries they distribute. so you have forks that strip it out: https://github.com/VSCodium/vscodium https://github.com/VSCodium/vscodium
craftyguy 8y ago
> I think it would be quite the day to take the hashes of Microsoft's ISO images for Windows, and compare it with the source code Wat? How would you translate an ISO hash into anything meaningful to compare to the actual source code (that you don't have access to, but that's beside the point) ? Does microsoft enforce reproducible builds[0]? Even if they did, you couldn't reproduce it (no access to source). When you hash a large binary, like an ISO, you cannot deconstruct what, eh, sub-binaries it is made of, and you cannot magically decompile those, eh, sub-binaries into source code. 0. https://wiki.debian.org/ReproducibleBuilds https://wiki.debian.org/ReproducibleBuilds
- techntoke 8y ago
  Yes, you can take a look at the source code and recompile the ISO to match the hash. If the compiled ISO hash doesn't match, then it isn't the same code.
  - craftyguy 8y ago
    No, you can literally do none of that with microsoft software.
- anticensor 8y ago
  Microsoft enforces reproducible builds since 2017.
  - craftyguy 8y ago
    Do you have a source for that (no pun intended)? Even if they did, it's impossible for anyone outside of microsoft to verify because, well, it's proprietary. So for those of us who trust microsoft as far as we can throw them, it doesn't really do much.
    - deleted 8y ago
      [deleted]
    - anticensor 8y ago
      Yes, see https://blogs.msdn.microsoft.com/oldnewthing/20180103-00/?p=97705 https://blogs.msdn.microsoft.com/oldnewthing/20180103-00/?p=... by Raymond Chen.
TickleSteve 8y ago
Thats not how backdoors work. Backdoors are subtle bugs introduced into the existing codebase. They are compiled into the build. They aren't added to the binary after the compilation by a malicious third party.
- bigiain 8y ago
  I'm not sure the term "backdoor" is that well defined. In Ken Thompson's "Reflections On Trusting Trust" Turing award lecture from 1984, he talked about "trojan horses" being inserted into the compiler in such a way that any code run through the compiler results in a program that has behaviour which is unable to be determined from examining the source code. They are "compiled into the build" by a malicious _compiler_, not from malicious bugs introduced into the source code. It's quite obvious that such behaviours could easily be things which deserve the name "backdoor". (It's only short, and _well_ worth the time needed to read it if you haven't come across it before: https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p7... )

I think it would be quite the day to take the hashes of Microsoft's ISO images for Windows, and compare it with the source code to check if there is government backdoors in the code.

leeoniya 8y ago

you can't even do that with their open source VSCode, since they add in branding/telemetry/licensing to the actual binaries they distribute. so you have forks that strip it out: https://github.com/VSCodium/vscodium https://github.com/VSCodium/vscodium

craftyguy 8y ago

> I think it would be quite the day to take the hashes of Microsoft's ISO images for Windows, and compare it with the source code Wat? How would you translate an ISO hash into anything meaningful to compare to the actual source code (that you don't have access to, but that's beside the point) ? Does microsoft enforce reproducible builds[0]? Even if they did, you couldn't reproduce it (no access to source). When you hash a large binary, like an ISO, you cannot deconstruct what, eh, sub-binaries it is made of, and you cannot magically decompile those, eh, sub-binaries into source code. 0. https://wiki.debian.org/ReproducibleBuilds https://wiki.debian.org/ReproducibleBuilds

techntoke 8y ago
Yes, you can take a look at the source code and recompile the ISO to match the hash. If the compiled ISO hash doesn't match, then it isn't the same code.
- craftyguy 8y ago
  No, you can literally do none of that with microsoft software.
anticensor 8y ago
Microsoft enforces reproducible builds since 2017.
- craftyguy 8y ago
  Do you have a source for that (no pun intended)? Even if they did, it's impossible for anyone outside of microsoft to verify because, well, it's proprietary. So for those of us who trust microsoft as far as we can throw them, it doesn't really do much.
  - deleted 8y ago
    [deleted]
  - anticensor 8y ago
    Yes, see https://blogs.msdn.microsoft.com/oldnewthing/20180103-00/?p=97705 https://blogs.msdn.microsoft.com/oldnewthing/20180103-00/?p=... by Raymond Chen.

TickleSteve 8y ago

Thats not how backdoors work. Backdoors are subtle bugs introduced into the existing codebase. They are compiled into the build. They aren't added to the binary after the compilation by a malicious third party.

bigiain 8y ago
I'm not sure the term "backdoor" is that well defined. In Ken Thompson's "Reflections On Trusting Trust" Turing award lecture from 1984, he talked about "trojan horses" being inserted into the compiler in such a way that any code run through the compiler results in a program that has behaviour which is unable to be determined from examining the source code. They are "compiled into the build" by a malicious _compiler_, not from malicious bugs introduced into the source code. It's quite obvious that such behaviours could easily be things which deserve the name "backdoor". (It's only short, and _well_ worth the time needed to read it if you haven't come across it before: https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p7... )