Reproducible builds are possible. Something like 94% of debian now builds reproducibly: https://tests.reproducible-builds.org/debian/stretch/index_s... and there's a post on reproducibility in Arch on the front page right now: https://news.ycombinator.com/item?id=15820356. Signal for Android builds reproducibly, too: https://signal.org/blog/reproducible-android/
Of course that only helps if you trust the toolchain.
Re:System76 ME Firmware Updates Plan
by bloodorange on Thursday November 30, 2017 @09:54PM
(#15821554)
Your comment reminds me of Ken Thompson's speech which he gave upon receiving the Turing Award: https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html
(Reflections on Trusting Trust)
The comparison between a person administering an unsecured computer network and a drunk driver has just made my list of legal IT analogies, along side BitTorrent being a car that might be used as the getaway vehicle in a robbery.
Thanks, I really enjoyed reading it!
> You'd need the compiler source, audit it for backdoors, then compile that with a trustworthy compiler. Then use the resulting compiler to compile the ME source.
It is possible (though somewhat time-intensive) to audit binaries, too. If there is real demand for this, it should be possible to crowdscale the auditing problem over a large group of OSS enthusiasts.
Intel can just give the source, but you can't trust Intel to just give you the same compiler they used, because the compiler might insert a backdoor. You'd need the compiler source, audit it for backdoors, then compile that with a trustworthy compiler. Then use the resulting compiler to compile the ME source.
(Compiler compiler compiler)