4 ms·

In Debian you can still get the sources, including the Debian specific patches, and build it yourself. There is no hard requirement to blindly trust the Debian

In Debian you can still get the sources, including the Debian specific patches, and build it yourself. There is no hard requirement to blindly trust the Debian maintainers.

izacus 5y ago
There's nothing guaranteeing that Deb contains the same thing as source Deb. At the end of the day you still need to trust the organization building your OS so they don't push a backdoor in your root installed package.
- Avamander 5y ago
  > There's nothing guaranteeing that Deb contains the same thing as source Deb. That's blatantly understating how many packages are reproducible.
  - izacus 5y ago
    No it's not - reproducibility doesn't defend you against malicious repository at all. You still need to trust every single maintainer of your packages and the repository owner to not serve you backdoored package.
    - w4rh4wk5 5y ago
      Yes and no. Just having reproducibility does not automatically prevent bad things from happening. But it's certainly easier to defend against them. Multiple people can grab the sources from the developer, review and apply the patches, build the package and publish the resulting hash. With reproducible builds, all people end up with the same hash, which should also be the same for the pre-built package in the repository. In other words, instead of trusting one single person (the maintainer) you split the trust across multiple people. This is definitely an improvement thanks to reproducible builds.
- zingplex 5y ago
  Isn't this exactly why they're doing the reproducible build stuff?
- sichtlinkair 5y ago
  > At the end of the day you still need to trust the organization building your OS so they don't push a backdoor in your root installed package. I am curious what are good solutions to this problem? Compile your OS (and any other software) from source?
  - content_sesh 5y ago
    Somewhere a Gentoo maintainer's ears are ringing, but they don't know why...
  - ex_amazon_sde 5y ago
    A backdoor/bugdoor is much more likely to be in the source code. Compiling the code by yourself does not help. You have to rely on a distribution that has a many-eyes review policy and has security conscious users.
- dbrgn 5y ago
  This is what reproducible builds try to fix: https://wiki.debian.org/ReproducibleBuilds https://wiki.debian.org/ReproducibleBuilds
- goodpoint 5y ago
  No, you can already download the source .debs, rebuild them and compare the results. And, there are large tech firms doing this already.
UncleMeat 5y ago
You can do the same thing here. There is no hard requirement that you use Google Play. If the app developers publish their source you can build an apk yourself.
- crazypython 5y ago
  Most apps on Google Play are proprietary and cannot be rebuilt.
  - UncleMeat 5y ago
    That is the developer's fault, surely.
    - w4rh4wk5 5y ago
      No, it's the developer's _choice_. The problem is that there are instances where you trust the developer but not the way it is distributed (commonly through Google's app store). I signature from the developer is enough to verify that the app has not been tempered with. With the upcoming change, we loose this verification when using Google's app store.
      - UncleMeat 5y ago
        This has nothing to do with the developer publishing the source and allowing you to build from source or publishing through other channels (the topic of this subthread). Developers can still create key pairs themselves and upload them to Google. So they can still publish their public key if they want and you can be certain that APKs distributed from somewhere other than Play were definitely signed by the developer.

In Debian you can still get the sources, including the Debian specific patches, and build it yourself. There is no hard requirement to blindly trust the Debian maintainers.

izacus 5y ago

There's nothing guaranteeing that Deb contains the same thing as source Deb. At the end of the day you still need to trust the organization building your OS so they don't push a backdoor in your root installed package.

Avamander 5y ago
> There's nothing guaranteeing that Deb contains the same thing as source Deb. That's blatantly understating how many packages are reproducible.
- izacus 5y ago
  No it's not - reproducibility doesn't defend you against malicious repository at all. You still need to trust every single maintainer of your packages and the repository owner to not serve you backdoored package.
  - w4rh4wk5 5y ago
    Yes and no. Just having reproducibility does not automatically prevent bad things from happening. But it's certainly easier to defend against them. Multiple people can grab the sources from the developer, review and apply the patches, build the package and publish the resulting hash. With reproducible builds, all people end up with the same hash, which should also be the same for the pre-built package in the repository. In other words, instead of trusting one single person (the maintainer) you split the trust across multiple people. This is definitely an improvement thanks to reproducible builds.
zingplex 5y ago
Isn't this exactly why they're doing the reproducible build stuff?
sichtlinkair 5y ago
> At the end of the day you still need to trust the organization building your OS so they don't push a backdoor in your root installed package. I am curious what are good solutions to this problem? Compile your OS (and any other software) from source?
- content_sesh 5y ago
  Somewhere a Gentoo maintainer's ears are ringing, but they don't know why...
- ex_amazon_sde 5y ago
  A backdoor/bugdoor is much more likely to be in the source code. Compiling the code by yourself does not help. You have to rely on a distribution that has a many-eyes review policy and has security conscious users.
dbrgn 5y ago
This is what reproducible builds try to fix: https://wiki.debian.org/ReproducibleBuilds https://wiki.debian.org/ReproducibleBuilds
goodpoint 5y ago
No, you can already download the source .debs, rebuild them and compare the results. And, there are large tech firms doing this already.

UncleMeat 5y ago

You can do the same thing here. There is no hard requirement that you use Google Play. If the app developers publish their source you can build an apk yourself.

crazypython 5y ago
Most apps on Google Play are proprietary and cannot be rebuilt.
- UncleMeat 5y ago
  That is the developer's fault, surely.
  - w4rh4wk5 5y ago
    No, it's the developer's _choice_. The problem is that there are instances where you trust the developer but not the way it is distributed (commonly through Google's app store). I signature from the developer is enough to verify that the app has not been tempered with. With the upcoming change, we loose this verification when using Google's app store.
    - UncleMeat 5y ago
      This has nothing to do with the developer publishing the source and allowing you to build from source or publishing through other channels (the topic of this subthread). Developers can still create key pairs themselves and upload them to Google. So they can still publish their public key if they want and you can be certain that APKs distributed from somewhere other than Play were definitely signed by the developer.