Foxboron

33 ms·

421.
by Foxboron 7y ago
Ok. Let's stop the efforts into patching toolchains. We only need cloudseal to make sure software is reproducible. Here is the catch: How do we bootstrap cloudseal in a reproducible fashion. We don't have cloudseal to do so. So we
422.
by Foxboron 7y ago
That does not change with this github registry. It's simply moving the binary storage. But as long as Github is not enforcing reproducible builds, or letting users pulling down build environments, the statue quo is still the same as to
423.
by Foxboron 7y ago
I personally use papis to keep track of my references and sources. Can probably be used for this. https://github.com/papis/papis
424.
by Foxboron 7y ago
It's a french spelling of the word "geeks" some devs told me.
425.
by Foxboron 8y ago
We are well aware of the challenges. Read a bit into the documentation and the efforts that has gone into achieving reproducible builds on different distributions. This is hard on distributions as we are suppose to support all the ecosystem
426.
by Foxboron 8y ago
Already adresse in the documentation in the form of "SOURCE_DATE_EPOCH". Adding these things to projects in general is terrible.
427.
by Foxboron 8y ago
For this problem, where the resulting code does not correspond to the published source code, reproducible builds is an adequate solution. https://reproducible-builds.org/docs/buy-in/ When it comes to verifying thi
428.
by Foxboron 8y ago
I hope this will help rubygems adopting reproducible builds. Currently their issue with SOURCE_DATE_EPOCH is not yet supported properly. https://github.com/rubygems/rubygems/issues/2290 https://rep
429.
by Foxboron 8y ago
The good news is that Daniel has not stopped experimenting with hardened android. https://github.com/AndroidHardening/
430.
Arch Linux propose changing compression method from xz to zstd(lists.archlinux.org)
18 points by Foxboron 8y ago|3 comments
431.
by Foxboron 8y ago
Content is never deleted from the AUR, so any PKGBUILD can be retrieved.
432.
by Foxboron 8y ago
>the same way as AUR -> community -> core works in Arch (which is the model I think is missing in Go). Arch packager here. It doesn't quite work like that. The distinction between community and extra is largely based on who
433.
by Foxboron 8y ago
Yo! Trusted user from Arch Linux. >On the other side of the spectrum, I've found that the official binary repositories for Arch Linux suffer many of the same issues described in the article for Debian. Patches being ignored and coll
434.
by Foxboron 8y ago
Also found this community edition linked on twitter: https://ghidrace.github.io/
435.
by Foxboron 8y ago
>Knowing the build was reproducible tells me nothing of value. It does. It proves that the given package was produced by the given source code. However, you can keep the timestamp as well! One of the goals of reproducible builds is to re
436.
by Foxboron 8y ago
But is it "reproducible" or reproducible? Holger still considers the debian numbers "reproducible" as we are only building things twice. To achieve proper reproducible builds the artifacts needs to be reproducible by use
437.
by Foxboron 8y ago
This is being actively worked on and already has had quite a bit of work. This project is also submitted to Google summer of code under the Debian project. https://ssl.engineering.nyu.edu/blog/2019-01-18-in-toto-pari...
438.
Secure the Public Go Module Ecosystem with the Go Notary(go.googlesource.com)
2 points by Foxboron 8y ago|0 comments
439.
by Foxboron 8y ago
So your threat model includes the cloud provider?
440.
by Foxboron 8y ago
>Encryption is useless when you store the keys on the same infrastucture. U.S may ask for keys as well. Are you claiming HSM are unsafe? >Even if you would store the keys on a local service at some point your data will lie/transi
441.
by Foxboron 8y ago
CVEs are traditionally limited to software packages. You wouldn't issue a CVE for the specification nor the cloud vendors.
442.
by Foxboron 8y ago
Podman was moved to the community repository a few days ago. https://www.archlinux.org/packages/community/x86_64/podman/
443.
by Foxboron 8y ago
And how is the build env recorded for timestamps and env variables? Is all of this standardized? >we do only integrity checks now for packages downloaded from npm and via opam Which is fine, but esy should be capable of accepting signatu
444.
by Foxboron 8y ago
I'm having a hard time figuring out if esy supports reproducable builds, and package signing+verfication. And if reproducable builds are supported, what format is used to store the build information so downloaded packages can be reprod
445.
by Foxboron 8y ago
>The culture sounds toxic, and the management sounds incompetent, and there's no force of change that has done anything to change that in the past ~5 years. The case regarding Daniel Micay and the Mozilla/Rust community is also
446.
by Foxboron 8y ago
A short redaction from this comment. I met up with Sebastian at 35C3 and we talked about it. We don't really disagree. He talked about their motivation for doing it in the first place, along with the larger community backslash and less
447.
by Foxboron 8y ago
"Be careful about pre-announcements because people will overrate the risk". It does not help their case when the pre-announcement is done through EFF that essentially says "GPG is broken". This is a horrendous strategy a
448.
by Foxboron 8y ago
Foxboron on IRC, else you can ship me emails on foxboron@archlinux.org. If you are into GPG, there will be some ad-hoc keysigning on the meetup :) https://lists.archlinux.org/pipermail/arch-events/2018-Decem...
449.
by Foxboron 8y ago
Feel free to contact! I'll be running the Arch Linux meetup. If you enjoy meeting people, I recommend attending whiskyleaks :) https://events.ccc.de/congress/2018/wiki/index.php/Session:W...
450.
by Foxboron 8y ago
It's hardly a cherry-pick. They have attempted to pull this of on AUR as well on two occasions.

More ›