4 ms·
So, we have source code for the signal app. We can audit that source code, to ensure no key-leakage occurs. Next, I install signal on my phone via the app sto
by rocqua 6y ago
So, we have source code for the signal app.
We can audit that source code, to ensure no key-leakage occurs.
Next, I install signal on my phone via the app store. How do I know the app I installed matches the source code that was audited? After all, google / Apple could decide / be forced to provide a modified binary.
Reproducible builds work for that.
Alternatively, consider debian. I ain't got time to compile every package I want from source (otherwise I'd run gentoo). Requires so much more dependency hell I'd rather avoid.
With reproducible builds, I can check the source for any package, and so can every other curious person. This way, instead of everyone needing to set up their own build environment for every package, we can all depend that once in a while, someone checks whether a build actually comes from trusted source code.
Is it less secure than building myself? YES. Does it make deploying compromised code more likely to be detected than without reproducible builds? Also yes!
Heck, if we change from "depend that once in a while, someone checks whether a build actually comes from trusted source code." To a federated system of trusted checkers. It gives pretty nice guarantees, and makes depolying compromised code pretty damn scary.
Essentially. Whenever the person compiling / signing the binary is not the person writing the source code, reproducible builds are pretty dang nice.
- filleokus 6y ago> Next, I install signal on my phone via the app store. How do I know the app I installed matches the source code that was audited? After all, google / Apple could decide / be forced to provide a modified binary. Reproducible builds work for that. At least on iOS it would be very hard to get a hash of the binary running on your phone, not possible without jailbreaking AFAIK? You could check it on your computer of course, but what's stopping $vendor from having an device.id == rocqua's phone check when they deliver the binary to your phone? Further, doesn't (at least) Apple do something with the signatures causing the binary downloaded to actually be slightly different and missmatch the one uploaded by the developer? If you don't trust your OS and in extension (at least on very locked down platforms as iOS) your OS vendor, it's basically game over. I mean, they have root on your connected device and could easily change what binary is started, even if you could verify the copy you downloaded onto disk.
- oefrha 6y ago> You could check it on your computer of course App Store-distributed ipas can’t be decrypted without keys burned into iOS hardware, so you can’t decrypt them on a Mac without a jailbroken iOS device. (You can hash the encrypted binary but of course that’s pretty useless for reproducibility.) This might be about to change since Apple has announced support for running iOS apps directly on Apple Silicon Macs?
- wildmanx 6y ago> Next, I install signal on my phone via the app store. How do I know the app I installed matches the source code that was audited? After all, google / Apple could decide / be forced to provide a modified binary. > Reproducible builds work for that. You read the original post, right? He discusses this at length. Actually, right in the beginning. In short, if you go through the dance of building the binary yourself to compare it to what's installed, then you could just use the binary that you just built, without ever looking at what the app store has.
- ISL 6y agoIf the app store distributes binaries to thousands of people, and only one of them rebuilds from source to check, those thousands of people gain a substantial (but not perfect) level of protection.
- ansible 6y agoYes, it would be "not community-minded" if you did a build, and it didn't match the app store, and you told no one.
- UncleEntity 6y agoSomeone, we'll call them Bob, goes to all the trouble to build the binary, finds out that it doesn't match with what the app store is distributing then just shrugs their shoulders and uses it to connect with other users in a secure messaging network because their binary is correct? What could possibly go wrong?
- rocqua 6y agoYou read my post aswell right? I don't want to check the binary myself. I want others to have that opportunity, so that tampering would be detected. I am lazy, reproducible builds let the diligent protect the lazy.
- neurostimulant 6y ago> Next, I install signal on my phone via the app store. How do I know the app I installed matches the source code that was audited? After all, google / Apple could decide / be forced to provide a modified binary. Isn't this already happening on both play store and app store? The actual package delivered to end users is actually generated and signed by google/apple, and they can modify the binary inside the package as they see fit (e.g. to optimize for each user's device arch, etc).
- rocqua 6y agoIf Google shows their modifications, it could still be checked against the source code.