4 ms·
If your threat model includes the hijacking of Mozilla's infrastructure, I assume you read and verify the entirety of the Firefox source with every new version
by calcifer 7y ago
If your threat model includes the hijacking of Mozilla's infrastructure, I assume you read and verify the entirety of the Firefox source with every new version before using it, right?
- phyzome 7y agoObviously not? But there are trustworthy people working with and integrating that code, there's a good chance they'll notice a hinky commit, and they're very close to having completely reproducible builds—which means that there can be verification that the shipped binary matches the inspected source. https://gregoryszorc.com/blog/2018/06/20/deterministic-firefox-builds/ https://gregoryszorc.com/blog/2018/06/20/deterministic-firef...