3 ms·
I feel like current understanding of reproducible builds stops short of solving the problem, particularly because I don't quite see users religiously building a
by aasasd 7y ago
I feel like current understanding of reproducible builds stops short of solving the problem, particularly because I don't quite see users religiously building and comparing the packages, especially hundreds of them.
A practical solution, IMO, would be several organizations running and publishing the builds—i.e. several independent F-Droids. Then, a few interested people could rather trivially automatically download the binaries and compare them. If one of the ‘stores’ gets compromised, a mismatch in binaries would indicate that.
This implies that versions should be built fully automatically from updated sources, without action on the part of the authors that is specific to the stores.
Edit: the idea of distributed builds, mentioned in the article, is similar—but IMO it's still unlikely that people will spend resources on apps that they personally don't use.
- brachi 7y agobut isn't the target users of F-droid developers? E.g. someone who could build things from scratch if they decide to go beyond trusting the signature?
- ardani 7y agoTech generally arrives in the consumer space only after becoming the standard for developers. Literal wizards, they build from source.
- dTal 7y agoI don't think that's the case at all. F-Droid is very user-friendly. It supports advanced users, but then all software should.
- aasasd 7y agoNo. I myself use F-Droid, and my knowledge of Android development consists of editing a line in an XML file in AnkiDroid and rebuilding the app with Gradle like the readme says. And even if the share of nerds is higher among F-Droid users, I still don't think coders often go “wait, this app is open-source, let me build it myself instead of getting a binary.”
- Foxboron 7y ago>A practical solution, IMO, would be several organizations running and publishing the builds—i.e. several independent F-Droids. Then, a few interested people could rather trivially automatically download the binaries and compare them. If one of the ‘stores’ gets compromised, a mismatch in binaries would indicate that. This idea has been discussed for years in the reproducible builds project. There has been some progress on this part on the Debian side of things, and you can in practice deploy rebuilders and make APT communicate and compare signed attestations. Lukas from NYU did a presentation during miniDebConf in June. https://www.youtube.com/watch?v=hbHa4OFv7Qo https://www.youtube.com/watch?v=hbHa4OFv7Qo Disclaimer: I worked on this project and contribute to the reproducible builds project.