3 ms·

Right on. The security paranoid experts and FOSS zealots have always thought for some inexplicable reasons that if you can download a source and build the prog

Right on. The security paranoid experts and FOSS zealots have always thought for some inexplicable reasons that if you can download a source and build the program yourself, then it's safe.

meditate 8y ago
It doesn't make it inherently safe, but if you are attempting to prove your builds are safe then it is impossible for anyone else to verify that without the source. See the thread on Debian reproducible builds from earlier this week for more discussion on this topic: https://news.ycombinator.com/item?id=19310638 https://news.ycombinator.com/item?id=19310638 Code signing is something you can do on both open-source or closed-source, but it doesn't prove anything other than that a particular build was made by a certain person.
- Spivak 8y ago
  "but it doesn't prove anything other than that a particular build was made by a certain person." But that's what trust actually is. This IRL person or identity, that I trust, vouches for the non-maliciousness of this application.
  - Nasrudith 8y ago
    Except the core problem is key propagation because just anyone can have a key - paid or free if you don't know the source. It says it is from Globe Software and it matches with the provided key. It doesn't tell you if they really are Globe Software, let alone if they are a trustworthy company in the first place.
0815test 8y ago
If your compiler correctly enforces security properties (and many languages do attempt to do this, at least in well-defined "safe" subsets), then of course any source code compiled with it is going to be safe. It's the difference between the JavaScript/WASM JIT-powered sandbox on the one hand, and the ActiveX code-signing-based model on the other. Which is safer?
- oarsinsync 8y ago
  I can visit a website and my CPU can get hammered to mine cryptocurrency for someone else without my consent. I'm not sure either is that much better at this point!
- CamperBob2 8y ago
  What? A compiler can't tell if a given program is "safe" any more than it can tell if the program will halt.
  - 0815test 8y ago
    A compiler can tell if some program will halt, for many reasonable cases. For example, if the program comes with a proof that places it in some well-defined computational complexity class, a compiler will be able to tell that it halts. And even if a program cannot be said to halt in general, it can still be said to halt conditional on some "unsafe" assertions being true. Similarly, we can verify safety properties for many useful programs, and we can even use "unsafe" assertions to limit the extent of uncertainty about these properties that we cannot directly verify.
craftyguy 8y ago
> if you can download a source and build the program yourself, then it's safe. I think only a loud (very small) minority think that. The rest of us know that's silly, and bringing it up to prove some point against "FOSS zealots" is also silly. FOSS does allow for independent code reviews (which do happen on some projects), but that's not the only reason FOSS > proprietary crap.
- hota_mazi 8y ago
  > but that's not the only reason FOSS > proprietary crap. Your use of "crap" to describe proprietary software betrays your bias. It's dangerous to be emotional when we're talking about security, it's important to remain objective and data driven. Not all proprietary software is crap and not all open source is safe. It's not that uncommon that companies whose very livelihood depends on their code being secure invest much more time and money auditing it, while open source is often a lot more lenient, because there's not real accountability nor negative effects for shipping insecure software.
  - craftyguy 8y ago
    Eh, it's crap because you have to trust the company pushing it out, it's 100% impossible (by definition) to verify source yourself, at least not legally. You could trust an open source developer, but you could also have a look at the code yourself, or pay for an independent security review of it if your business depends on it.

Right on. The security paranoid experts and FOSS zealots have always thought for some inexplicable reasons that if you can download a source and build the program yourself, then it's safe.

meditate 8y ago

It doesn't make it inherently safe, but if you are attempting to prove your builds are safe then it is impossible for anyone else to verify that without the source. See the thread on Debian reproducible builds from earlier this week for more discussion on this topic: https://news.ycombinator.com/item?id=19310638 https://news.ycombinator.com/item?id=19310638 Code signing is something you can do on both open-source or closed-source, but it doesn't prove anything other than that a particular build was made by a certain person.

Spivak 8y ago
"but it doesn't prove anything other than that a particular build was made by a certain person." But that's what trust actually is. This IRL person or identity, that I trust, vouches for the non-maliciousness of this application.
- Nasrudith 8y ago
  Except the core problem is key propagation because just anyone can have a key - paid or free if you don't know the source. It says it is from Globe Software and it matches with the provided key. It doesn't tell you if they really are Globe Software, let alone if they are a trustworthy company in the first place.

0815test 8y ago

If your compiler correctly enforces security properties (and many languages do attempt to do this, at least in well-defined "safe" subsets), then of course any source code compiled with it is going to be safe. It's the difference between the JavaScript/WASM JIT-powered sandbox on the one hand, and the ActiveX code-signing-based model on the other. Which is safer?

oarsinsync 8y ago
I can visit a website and my CPU can get hammered to mine cryptocurrency for someone else without my consent. I'm not sure either is that much better at this point!
CamperBob2 8y ago
What? A compiler can't tell if a given program is "safe" any more than it can tell if the program will halt.
- 0815test 8y ago
  A compiler can tell if some program will halt, for many reasonable cases. For example, if the program comes with a proof that places it in some well-defined computational complexity class, a compiler will be able to tell that it halts. And even if a program cannot be said to halt in general, it can still be said to halt conditional on some "unsafe" assertions being true. Similarly, we can verify safety properties for many useful programs, and we can even use "unsafe" assertions to limit the extent of uncertainty about these properties that we cannot directly verify.

craftyguy 8y ago

> if you can download a source and build the program yourself, then it's safe. I think only a loud (very small) minority think that. The rest of us know that's silly, and bringing it up to prove some point against "FOSS zealots" is also silly. FOSS does allow for independent code reviews (which do happen on some projects), but that's not the only reason FOSS > proprietary crap.

hota_mazi 8y ago
> but that's not the only reason FOSS > proprietary crap. Your use of "crap" to describe proprietary software betrays your bias. It's dangerous to be emotional when we're talking about security, it's important to remain objective and data driven. Not all proprietary software is crap and not all open source is safe. It's not that uncommon that companies whose very livelihood depends on their code being secure invest much more time and money auditing it, while open source is often a lot more lenient, because there's not real accountability nor negative effects for shipping insecure software.
- craftyguy 8y ago
  Eh, it's crap because you have to trust the company pushing it out, it's 100% impossible (by definition) to verify source yourself, at least not legally. You could trust an open source developer, but you could also have a look at the code yourself, or pay for an independent security review of it if your business depends on it.