4 ms·

How will Mozilla guarantee/verify that each blob being downloaded by the users of Firefox is built from that same source code?

by ghoul2 13y ago

meepmorp 13y ago
By building and supplying those blobs to users?
- ghoul2 13y ago
  They can't "supply". Cisco has the patent license with MPEG LA, not Mozilla. As per the announcement, each firefox user will have to download the blob directly from Cisco.
  - meepmorp 13y ago
    By building the source code independently and verifying the hash on the downloaded blob? There's ways around the problem.
  - tedunangst 13y ago
    Can Mozilla build the binary and provide it to Cisco?
  - e12e 13y ago
    Makes one wonder about the cost of bandwidth vs. the licence cost...
briansmith 13y ago
I don't know the exact plan since I'm not working on this, but it would be relatively easy for us to do: 1. Insist that the exact build configurations used by Cisco be open-sourced along with the rest of the code. 2. Require that every binary distributed by Cisco by tagged with the revision control revision ID. 3. Internally at Mozilla, build that revision of the code and compare the result to the binary blob that we would download from Cisco. Note we'd never distribute the outputs of our internal builds; we'd use those builds only to verify that the source code matches what we'd download. 4a: When we verify that the outputs match exactly, update some embedded hashes within Firefox to approve those versions of the binary blob for download/install, or 4b: Cisco could ask Mozilla to sign these blobs for them, and Mozilla would sign the blobs after doing the above checks. Then, the Firefox client would just verify that the blobs were signed by Mozilla's public key.
- ghoul2 13y ago
  Actually, on second thoughts - yes, you are right. This could work - partially. But the other way around. Mozilla could build the blobs, sign them and then send them to Cisco who would then provide the download infrastructure. It still won't allow a third party to verify the same and would require everyone to trust Mozilla itself. Its less problematic than having to trust Cisco, but far from ideal. On that note: do you know if the blob download would be wrapped in a Cisco EULA?
  - BrendanEich 13y ago
    We can't build blobs without taking the MPEG LA license. Blobs can be verified against the open source. See https://madiba.encs.concordia.ca/~x_decarn/truecrypt-binaries-analysis/ https://madiba.encs.concordia.ca/~x_decarn/truecrypt-binarie.... More on this in a future blog post. /be
hsivonen 13y ago
From a person involved with this at Cisco: "All the build scripts etc that Cisco uses will be part of the open source project so that anyone can build it them selves and check that their build matches the Cisco binary and check the code does not have backdoors to send all your video to the NSA." http://www.ietf.org/mail-archive/web/rtcweb/current/msg09293.html http://www.ietf.org/mail-archive/web/rtcweb/current/msg09293...

How will Mozilla guarantee/verify that each blob being downloaded by the users of Firefox is built from that same source code?

by ghoul2 13y ago

How will Mozilla guarantee/verify that each blob being downloaded by the users of Firefox is built from that same source code?

meepmorp 13y ago

By building and supplying those blobs to users?

ghoul2 13y ago
They can't "supply". Cisco has the patent license with MPEG LA, not Mozilla. As per the announcement, each firefox user will have to download the blob directly from Cisco.
- meepmorp 13y ago
  By building the source code independently and verifying the hash on the downloaded blob? There's ways around the problem.
- tedunangst 13y ago
  Can Mozilla build the binary and provide it to Cisco?
- e12e 13y ago
  Makes one wonder about the cost of bandwidth vs. the licence cost...

briansmith 13y ago

I don't know the exact plan since I'm not working on this, but it would be relatively easy for us to do: 1. Insist that the exact build configurations used by Cisco be open-sourced along with the rest of the code. 2. Require that every binary distributed by Cisco by tagged with the revision control revision ID. 3. Internally at Mozilla, build that revision of the code and compare the result to the binary blob that we would download from Cisco. Note we'd never distribute the outputs of our internal builds; we'd use those builds only to verify that the source code matches what we'd download. 4a: When we verify that the outputs match exactly, update some embedded hashes within Firefox to approve those versions of the binary blob for download/install, or 4b: Cisco could ask Mozilla to sign these blobs for them, and Mozilla would sign the blobs after doing the above checks. Then, the Firefox client would just verify that the blobs were signed by Mozilla's public key.

ghoul2 13y ago
Actually, on second thoughts - yes, you are right. This could work - partially. But the other way around. Mozilla could build the blobs, sign them and then send them to Cisco who would then provide the download infrastructure. It still won't allow a third party to verify the same and would require everyone to trust Mozilla itself. Its less problematic than having to trust Cisco, but far from ideal. On that note: do you know if the blob download would be wrapped in a Cisco EULA?
- BrendanEich 13y ago
  We can't build blobs without taking the MPEG LA license. Blobs can be verified against the open source. See https://madiba.encs.concordia.ca/~x_decarn/truecrypt-binaries-analysis/ https://madiba.encs.concordia.ca/~x_decarn/truecrypt-binarie.... More on this in a future blog post. /be

hsivonen 13y ago

From a person involved with this at Cisco: "All the build scripts etc that Cisco uses will be part of the open source project so that anyone can build it them selves and check that their build matches the Cisco binary and check the code does not have backdoors to send all your video to the NSA." http://www.ietf.org/mail-archive/web/rtcweb/current/msg09293.html http://www.ietf.org/mail-archive/web/rtcweb/current/msg09293...