4 ms·

Have you read the client code? How would you know? Just because the protocol is well-formed doesn’t mean the totality of the implementation is trustworthy. #S

Have you read the client code? How would you know? Just because the protocol is well-formed doesn’t mean the totality of the implementation is trustworthy. #ShowUsTheCode

dymk 7y ago
Reading the client code means bupkis. Trust is not derived from source code, but from where you got your stack (phone hardware, operating system, build tools, application source code, distribution platform included). https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p7...
- gfodor 7y ago
  Clearly its derived from all of the above. The end goal we have for Hubs (hubs.mozilla.com) is to allow the theoretical limit of auditing to be done by the public when using our hosted services wrt both the code and the operations. And ofc, you can always run the bits yourself if you don't trust that audit.
  - the_pwner224 7y ago
    I went to hubs.mozilla.com and couldn't figure out what it does. I then tried making/joining a Hub but it got stalled at one of the loading steps so I still couldn't figure out what a Hub is. They seem to be VR meeting spaces: https://blog.mozvr.com/introducing-hubs-a-new-way-to-get-together-online/ https://blog.mozvr.com/introducing-hubs-a-new-way-to-get-tog... The model you describe seems like a good one, similar to what most Linux distributions do. The distro maintainers are trusted and they compile packages and distribute the binaries, but people can run the package generation scripts themselves to get their own package straight from the source. Reproducible builds allow users to confirm that the maintainers aren't doing anything sketchy - that probably isn't a possibility here, but this model is still far better than what FB/WhatsApp and even Signal do.
    - gfodor 7y ago
      Sorry you hit a snag. Yes, we're building a web-based avatar-centric communications tool, which also supports VR. If you have more info on your setup (browser, OS, link to the room that failed) and what you saw that'd be fantastic so we can fix it! Feel free to email me directly gfodor at mozilla.com.
idlewords 7y ago
Read the client code? Bah! How do you know that's what's in the compiled binary?
- mises 7y ago
  Reproducible builds. This is pretty much exactly their purpose.
  - idlewords 7y ago
    The non-facetious point here is that you have to root your trust in something (whether that's the maker of your reproducible build system, or your device, or your app, or the online service you use, or the chip foundry that made the CPU that runs your built-from-scratch-paranoid-OS). It's better to have to trust somewhat verifiable promises about the Facebook app than to have to trust unverifiable promises about Facebook-the-entire-organization. That's the advantage that E2E provides.

Have you read the client code? How would you know? Just because the protocol is well-formed doesn’t mean the totality of the implementation is trustworthy. #ShowUsTheCode

dymk 7y ago

Reading the client code means bupkis. Trust is not derived from source code, but from where you got your stack (phone hardware, operating system, build tools, application source code, distribution platform included). https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p7...

gfodor 7y ago
Clearly its derived from all of the above. The end goal we have for Hubs (hubs.mozilla.com) is to allow the theoretical limit of auditing to be done by the public when using our hosted services wrt both the code and the operations. And ofc, you can always run the bits yourself if you don't trust that audit.
- the_pwner224 7y ago
  I went to hubs.mozilla.com and couldn't figure out what it does. I then tried making/joining a Hub but it got stalled at one of the loading steps so I still couldn't figure out what a Hub is. They seem to be VR meeting spaces: https://blog.mozvr.com/introducing-hubs-a-new-way-to-get-together-online/ https://blog.mozvr.com/introducing-hubs-a-new-way-to-get-tog... The model you describe seems like a good one, similar to what most Linux distributions do. The distro maintainers are trusted and they compile packages and distribute the binaries, but people can run the package generation scripts themselves to get their own package straight from the source. Reproducible builds allow users to confirm that the maintainers aren't doing anything sketchy - that probably isn't a possibility here, but this model is still far better than what FB/WhatsApp and even Signal do.
  - gfodor 7y ago
    Sorry you hit a snag. Yes, we're building a web-based avatar-centric communications tool, which also supports VR. If you have more info on your setup (browser, OS, link to the room that failed) and what you saw that'd be fantastic so we can fix it! Feel free to email me directly gfodor at mozilla.com.

idlewords 7y ago

Read the client code? Bah! How do you know that's what's in the compiled binary?

mises 7y ago
Reproducible builds. This is pretty much exactly their purpose.
- idlewords 7y ago
  The non-facetious point here is that you have to root your trust in something (whether that's the maker of your reproducible build system, or your device, or your app, or the online service you use, or the chip foundry that made the CPU that runs your built-from-scratch-paranoid-OS). It's better to have to trust somewhat verifiable promises about the Facebook app than to have to trust unverifiable promises about Facebook-the-entire-organization. That's the advantage that E2E provides.