3 ms·
Add to that: "I designed it" (and was checked) "I built it myself" Which is actually cumulative with what you wrote. We currently have a bit of a "trusting t
by MayeulC 7y ago
Add to that:
"I designed it" (and was checked)
"I built it myself"
Which is actually cumulative with what you wrote. We currently have a bit of a "trusting trust" issue with open hardware: how do you check that the fab didn't tamper with your ICs before manufacturing them?
- dmos62 7y ago> how do you check that the fab didn't tamper with your ICs Same goes for deployable software. How do you know that that program is compiled from that source?
- MayeulC 7y agoThat's quite easy actually: with reproducible builds, hashes and signatures. None of this is possible or easy to do in the hardware world.
- dmos62 7y agoSuppose you have the source code for gmail: how do you know that what you're interacting with when you're on gmail.com is compiled from that?
- MayeulC 7y agoGmail is kind of tricky, I am not sure if you are talking about the web interface or something else. The web interface is a slightly more complex case, as you'd have to patch the browser, and check every piece of javascript. You cannot check the server part yourself, of course. But you wouldn't use SAAS if you were interested in security in the first place, unless you trust Google's servers, in which case HTTPS+HSTS (+cert pinning?) should be enough. Otherwise (android app? Browser js/html/css?) you separately compile gmail. Assuming the build is reproductible, you can check that its hash corresponds to what was sent to you.