5 ms·

WRT to this bit: > truly every single app is built from source and therefore F-Droid’s build infrastructure is highly secured, with only Ciaran Gultnieks, who

WRT to this bit: > truly every single app is built from source and therefore F-Droid’s build infrastructure is highly secured, with only Ciaran Gultnieks, who founded the project almost nine years ago, having access to it. What assurances (including legal) are there (besides best intentions) that Ciaran Gultnieks is the only one that has access to the infrastructure that builds F-droid? Also what happens if Ciaran no longer works on the project?

rectang 7y ago
> what happens if Ciaran no longer works on the project? You get a situation like QuadrigaCX when CEO Gerald Cotten passed away and 190 USD in bitcoin became unavailable. https://www.quadrigacxtrustee.com/ https://www.quadrigacxtrustee.com/ Or, to address the problem, something like Shamir's Secret Sharing algorithm could help.
- Avamander 7y ago
  I don't know why the downvotes, the bus factor in this case is 1 and that's horrible.
  - codewiz 7y ago
    Where does HN display the downvote count for a post?
    - ardani 7y ago
      I don't think downvote counts are shown, even to high-karma posters.
    - vinceguidry 7y ago
      You can get a sense for how much a post is being downvoted by the shade of gray the post is displayed with. The closer to white, the more downvotes. HN stopped greying out your own posts, so it's not easy to determine exactly how the behavior is implemented. Personally, I find the greying of a post on even a single downvote to be quite unfortunate and easily abused. I feel a post should only start greying on the second downvote.
      - brewdad 7y ago
        I find it useful and will upvote gray posts that I feel have been downvoted over disagreement rather than truly deserving the downvote. It's probably my most common reason for upvoting.
        akerl_ 7y ago
        It’s potentially worth noting that downvoting over disagreement is considered in-line with the rules: https://news.ycombinator.com/item?id=17996858 https://news.ycombinator.com/item?id=17996858
- MaxBarraclough 7y ago
  $190m. Better source: https://www.theguardian.com/technology/2019/feb/04/quadrigacx-canada-cryptocurrency-exchange-locked-gerald-cotten https://www.theguardian.com/technology/2019/feb/04/quadrigac...
zimbatm 7y ago
Because the builds are reproducible, it means that anyone can re-build the projects and verify that the output is the same, independently. That's the beauty of it, it's the only system that doesn't need a chain of trust. That being said, I don't know enough about the project to say if there are actually people doing the verification work.
- akerl_ 7y ago
  I think it would be more precise to say that reproducible builds rely on asynchronous trust: individual users trust the pre-built packages on the expectation that some users are building from source and comparing against the package results. It’s worth noting here that it’s not sufficient for some users to build from source for their own usage: they have to additionally compare their build results against the version served by the repository, and then they have to publicize if there’s a mismatch. As somebody who builds many things from source, but has never attempted to validate a packaged repo using my results, I’m curious: does anybody here perform this validation?
  - bovine3dom 7y ago
    Mozilla's add-on reviewers do. I know because our build wasn't totally reproducible and they made us make it so.

rectang 7y ago

> what happens if Ciaran no longer works on the project? You get a situation like QuadrigaCX when CEO Gerald Cotten passed away and 190 USD in bitcoin became unavailable. https://www.quadrigacxtrustee.com/ https://www.quadrigacxtrustee.com/ Or, to address the problem, something like Shamir's Secret Sharing algorithm could help.

Avamander 7y ago
I don't know why the downvotes, the bus factor in this case is 1 and that's horrible.
- codewiz 7y ago
  Where does HN display the downvote count for a post?
  - ardani 7y ago
    I don't think downvote counts are shown, even to high-karma posters.
  - vinceguidry 7y ago
    You can get a sense for how much a post is being downvoted by the shade of gray the post is displayed with. The closer to white, the more downvotes. HN stopped greying out your own posts, so it's not easy to determine exactly how the behavior is implemented. Personally, I find the greying of a post on even a single downvote to be quite unfortunate and easily abused. I feel a post should only start greying on the second downvote.
    - brewdad 7y ago
      I find it useful and will upvote gray posts that I feel have been downvoted over disagreement rather than truly deserving the downvote. It's probably my most common reason for upvoting.
      - akerl_ 7y ago
        It’s potentially worth noting that downvoting over disagreement is considered in-line with the rules: https://news.ycombinator.com/item?id=17996858 https://news.ycombinator.com/item?id=17996858
MaxBarraclough 7y ago
$190m. Better source: https://www.theguardian.com/technology/2019/feb/04/quadrigacx-canada-cryptocurrency-exchange-locked-gerald-cotten https://www.theguardian.com/technology/2019/feb/04/quadrigac...

zimbatm 7y ago

Because the builds are reproducible, it means that anyone can re-build the projects and verify that the output is the same, independently. That's the beauty of it, it's the only system that doesn't need a chain of trust. That being said, I don't know enough about the project to say if there are actually people doing the verification work.

akerl_ 7y ago
I think it would be more precise to say that reproducible builds rely on asynchronous trust: individual users trust the pre-built packages on the expectation that some users are building from source and comparing against the package results. It’s worth noting here that it’s not sufficient for some users to build from source for their own usage: they have to additionally compare their build results against the version served by the repository, and then they have to publicize if there’s a mismatch. As somebody who builds many things from source, but has never attempted to validate a packaged repo using my results, I’m curious: does anybody here perform this validation?
- bovine3dom 7y ago
  Mozilla's add-on reviewers do. I know because our build wasn't totally reproducible and they made us make it so.