4 ms·

Debian builds and signs which is rather different from just signing what someone else builds. This makes sense for Debian since they often make changes to the

by blihp 5y ago

Debian builds and signs which is rather different from just signing what someone else builds. This makes sense for Debian since they often make changes to the upstream code a bit, primarily for consistency with the rest of the distro, which you can see in the source packages. It's good for the signing party to be the one who built it asserting 'this is what we intended to ship'. It's also very clear that they are Debian packages, rather than anything originating from the upstream author(s). That's a very different thing than Google's new policy.

izacus 5y ago
It sounds exactly the same to me - the repository owner is the one signing packages and has to be trusted not to modify it before delivering data. Where's the difference?
- blihp 5y ago
  I think to me it boils down to need and trust. Debian needs to do things this way and has earned trust over decades not to abuse its power. Google doesn't have the need and is burning trust in enough other areas where it doesn't instill a lot of confidence that they will not abuse the increased control.
  - izacus 5y ago
    That I agree with and is actually my point - you NEED to trust your platform. There's just no other way. There's no sensible way for you to keep using Googles platform if you use Googles OS.
- dredmorbius 5y ago
  There are cases in which upstream (the original developer) and the Debian packager (Debian Developer) are one and the same. Not many but some. Debian is also the developer and packager of a large set of the core packages. Upstream can sign or otherwise indicate integrity (e.g., Git revision checksums) of all individual source files. This ... becomes tedious to check, but can be checked against Debian sources to identify where any changes might reside. Note that this still applies only to sources rather than builds, though it's an option. It's likely not an option in wide use. Debian also ships sources rather than builds, which can be built directly on your own systems (or within your own build-and-distribution network). Debian's had a "reproducible builds" initiative for some years (https://wiki.debian.org/ReproducibleBuilds https://wiki.debian.org/ReproducibleBuilds), and this covers a fair number of packages (I don't have a count offhand), though there are notable exceptions of packages which are simply too complex to build reproducibly. I think the September 2020 summit notes are the best current overview of status, tools, and issues: https://reproducible-builds.org/reports/2020-09/ https://reproducible-builds.org/reports/2020-09/ And, unlike Google Play, it's possible to download from any arbitrary Debian mirror without authentication. Authentication-prior-to-download could lead to branching logic for user-specific modified packages being delivered. Another option of course being for a generically-modified package that targets a single user or specified set of narrow criteria.
- JeremyNT 5y ago
  Debian does everything in the open. You can download the source of a package and build it yourself, compare checksums, run diffs. Most packages have reproducible builds so you can confirm what you're getting! Debian also doesn't require or use an "account" for downloads, and if they release a version of something, it's on the public mirrors that many people will be able to access. With Google the entire process is completely opaque, they do everything behind closed doors, and can hand different users different blobs on demand. Ultimately with Google, you only have Google's word for what they're doing, and you know they have the capability to provide different versions to different users on demand of an NSL. With Debian, they have no way to attack a specific user, and you fully have the ability to "check their work."
goodpoint 5y ago
There is more: Debian maintainers review the software and sometimes disable antifeatures like tracking.

by blihp 5y ago

izacus 5y ago

It sounds exactly the same to me - the repository owner is the one signing packages and has to be trusted not to modify it before delivering data. Where's the difference?

blihp 5y ago
I think to me it boils down to need and trust. Debian needs to do things this way and has earned trust over decades not to abuse its power. Google doesn't have the need and is burning trust in enough other areas where it doesn't instill a lot of confidence that they will not abuse the increased control.
- izacus 5y ago
  That I agree with and is actually my point - you NEED to trust your platform. There's just no other way. There's no sensible way for you to keep using Googles platform if you use Googles OS.
dredmorbius 5y ago
There are cases in which upstream (the original developer) and the Debian packager (Debian Developer) are one and the same. Not many but some. Debian is also the developer and packager of a large set of the core packages. Upstream can sign or otherwise indicate integrity (e.g., Git revision checksums) of all individual source files. This ... becomes tedious to check, but can be checked against Debian sources to identify where any changes might reside. Note that this still applies only to sources rather than builds, though it's an option. It's likely not an option in wide use. Debian also ships sources rather than builds, which can be built directly on your own systems (or within your own build-and-distribution network). Debian's had a "reproducible builds" initiative for some years (https://wiki.debian.org/ReproducibleBuilds https://wiki.debian.org/ReproducibleBuilds), and this covers a fair number of packages (I don't have a count offhand), though there are notable exceptions of packages which are simply too complex to build reproducibly. I think the September 2020 summit notes are the best current overview of status, tools, and issues: https://reproducible-builds.org/reports/2020-09/ https://reproducible-builds.org/reports/2020-09/ And, unlike Google Play, it's possible to download from any arbitrary Debian mirror without authentication. Authentication-prior-to-download could lead to branching logic for user-specific modified packages being delivered. Another option of course being for a generically-modified package that targets a single user or specified set of narrow criteria.
JeremyNT 5y ago
Debian does everything in the open. You can download the source of a package and build it yourself, compare checksums, run diffs. Most packages have reproducible builds so you can confirm what you're getting! Debian also doesn't require or use an "account" for downloads, and if they release a version of something, it's on the public mirrors that many people will be able to access. With Google the entire process is completely opaque, they do everything behind closed doors, and can hand different users different blobs on demand. Ultimately with Google, you only have Google's word for what they're doing, and you know they have the capability to provide different versions to different users on demand of an NSL. With Debian, they have no way to attack a specific user, and you fully have the ability to "check their work."

goodpoint 5y ago

There is more: Debian maintainers review the software and sometimes disable antifeatures like tracking.