4 ms·
How would we know unless we can read (and compile) the source code?
by jadeddrag 11y ago
How would we know unless we can read (and compile) the source code?
- Someone1234 11y agoConsidering how few people read and compile the Linux source code, how do you know on Linux? Most distributions are binary, not source.
- lelandbatey 11y agoWhile that's true, I still know people who compile their own OS from scratch; I've gone through the experience of compiling my entire system from source via Linux From Scratch[0]. There are many thousands of people who have done the same thing, and this gives us a "web of trust". And if you don't want to trust anyone, you can always compile it yourself. That's the difference: I have the freedom to learn and study anything and everything. It might not be likely, and it might not be convenient, but it is possible. [0] - http://www.linuxfromscratch.org/lfs/view/stable/ http://www.linuxfromscratch.org/lfs/view/stable/
- schoen 11y agoFortunately that will change for Debian, and, we can hope, Debian-based distributions. https://wiki.debian.org/ReproducibleBuilds https://wiki.debian.org/ReproducibleBuilds (I gave a talk about this at CCC. The status quo is a reason why free software doesn't have some of the transparency benefits over proprietary software we might expect, if you fear some developer is attacking you or someone is attacking some developers' infrastructure.)
- throwawayaway 11y agojeez, great post. sorry for my bad humour at you the other day. es tut mir leid.
- yellowapple 11y agoI'm not sure about reading, but several distributions (notably, Gentoo and Slackware) encourage (and in the former case, require) users to configure and compile Linux from source instead of relying on a binary installation. Of course, this doesn't do anything against a malicious install environment or a backdoored compiler, but it's a start.
- caskance 11y agoYes, and that's why so few people use those distributions.
- yellowapple 11y agoNever claimed they were popular. Just that Linux From Scratch isn't the only option for those wishing to to run a kernel they built from source.
- UK-AL 11y agoPeople have, and do have access to it. Windows Research kernel. Kernel leaks, etc. Generally the code quality is considered good.
- jadeddrag 11y agoI'm sure that the NSA agrees with you.
- breischl 11y agoYes they do! They also apparently like OSX, iOS, and RHEL.[1] Oh wait, you were just trying to score cheap snark points, weren't you? [1] - https://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/operating_systems.shtml https://www.nsa.gov/ia/mitigation_guidance/security_configur...
- jadeddrag 11y agoYour link shows us how the NSA would like you to secure your systems, not their love for hiding their exploits behind closed sourced code. No snark points needed here!