News for hackers. Stuff that matters.

A comment on AMD ships microcode update to disable some branch prediction. Parent comment

Re:AMD ships microcode update to disable some branch prediction by dmytroi on Friday January 05, 2018 @06:44PM (#16082768)
As much as I would love to believe that I personally can sanely inspect all the code I run - I can't. One day I run apt-get install git and I have to trust all code that is being pulled to my machine (and there is a lot of code there) simply because my lifespan is probably shorter then time required to audit all the code in git dependencies (ssl, crt, kernel, etc). So given I can't possibly audit everything, then I need to trust, and if I need to trust, then being FOSS might make me feel a bit more sure about safety of the code, but in reality it might not even make such a difference - apt-get pulls-in binaries, who knows what/how/where this binaries are made ... trust chain is simply not there.

I personally trust FOSS software more not to do dumb things (like, hopefully my password manager doesn't report all my passwords to NSA), but simply being FOSS doesn't make it any more secure :)

[ Parent | on HN ]
Re:AMD ships microcode update to disable some branch prediction by cesarb on Friday January 05, 2018 @08:10PM (#16083194)
> who knows what/how/where this binaries are made

Reproducible builds (https://reproducible-builds.org/) is an initiative to fix that part of the problem. With reproducible builds, a third party with the same source code and compiler will get an identical binary, so we can have independent entities certifying that the code you download with apt-get was built from the corresponding source code.

[ Parent | on HN ]