3 ms·
So much time has been wasted on reproducible builds which could have better spent on securing more important parts of Debian. Practically minor changes like a b
by charcircuit 6mo ago
So much time has been wasted on reproducible builds which could have better spent on securing more important parts of Debian. Practically minor changes like a build timestamp being different is not an issue.
- Hendrikto 6mo agoIt allows verifying that the binaries actually match the source, which is extremely valuable.
- charcircuit 6mo agoBit for bit matching is not required for that.
- Hendrikto 6mo agoIt makes it much simpler and more robust though. Also, it allows for content addressing a la Nix, among other benefits.
- charcircuit 6mo agoI reject that those benefits are actually that useful compared to the effort needed to do so. You can content addressing without reproducible builds. You just have a canonical version, which typically is built by the application developer.
- farfatched 6mo agoYes, making sure build timestamps are reproducible isn't a security win. What is a win is that two independent parties can run the same build, and get the same binaries. This is important because it removes trust from builders: anyone can verify their output. It just so happens that unimportant things like build versions impede that.
- charcircuit 6mo agoAnyone can verify the actual code in the binary matches even if some bytes within the binary file itself are different. The verification routine doesn't have to be a basic bit for bit equality test.
- farfatched 6mo agoFor sure. This has been the status quo in Debian for a while now. You can build, and use diffoscope to audit the differences. It's a stronger security property to have bit-for-bit reproducibilty, and it looks like Debian are ready to commit to it.
- charcircuit 6mo agoYou are just restating the point of the thread and not addressing the low return on investment doing this is.
- farfatched 6mo agoFair point. I had figured the cost would decrease in time as deterministic builds became the norm (i.e. build tools stop including build timestamps). I agree that it might not have positive POI. Bit tricky for me to judge.
- deknos 6mo agoyou are free to provide patches instead of bitching.
- charcircuit 6mo agoAnd Debian is able to offer me a few million dollars yearly to help fix their security situation.
- deknos 6mo agothe idea that debian has a few million dollars to spare creates the assumption, that even if they would have... you would either not know how to fix issues, or not worth it.