6 ms·
Reproducible builds would've had a sporting chance of defeating the solarwinds attack, because the injection point was on particular build servers that were rea
by jacques_chester 6y ago
Reproducible builds would've had a sporting chance of defeating the solarwinds attack, because the injection point was on particular build servers that were reached through other vectors. If a second party performs a build to verify it, the attacker now has ~2x the cost to conceal their attack.
- dathinab 6y agoTrue, but this requires the source you build not to have been gone through the build server, which is reasonable. The thing is you can circumvent this by attacking the version control and/or developer systems. And at least the later one are often massively vulnerable to certain kind of supply chain attacks. Ironically the permissions and setups commonly used for a nice development flow are also making systems vulnerable for many kinds of supply chain attacks. I'm currently slowly moving to a more secure dev flow, but it adds overhead. Especially if your dev system is also your laptop. First step is to run any kind of dev tool (especially builds) in a container. Through this often also means running e.g. a language server in the container while running your IDE out of it and making sure nothing will trigger your IDE to do thinks outside of the container...
- jacques_chester 6y agoNone of these solutions is complete, but that's not a final argument against them. Raising the cost of attack is always beneficial. It reduces the number of attackers and the number of attacks.