Because the builds are reproducible, it means that anyone can re-build the projects and verify that the output is the same, independently. That's the beauty of it, it's the only system that doesn't need a chain of trust.

That being said, I don't know enough about the project to say if there are actually people doing the verification work.

I think it would be more precise to say that reproducible builds rely on asynchronous trust: individual users trust the pre-built packages on the expectation that some users are building from source and comparing against the package results.

It’s worth noting here that it’s not sufficient for some users to build from source for their own usage: they have to additionally compare their build results against the version served by the repository, and then they have to publicize if there’s a mismatch.

As somebody who builds many things from source, but has never attempted to validate a packaged repo using my results, I’m curious: does anybody here perform this validation?

Mozilla's add-on reviewers do. I know because our build wasn't totally reproducible and they made us make it so.

> what happens if Ciaran no longer works on the project?

You get a situation like QuadrigaCX when CEO Gerald Cotten passed away and 190 USD in bitcoin became unavailable.

https://www.quadrigacxtrustee.com/

Or, to address the problem, something like Shamir's Secret Sharing algorithm could help.

$190m.

Better source: https://www.theguardian.com/technology/2019/feb/04/quadrigac...

I don't know why the downvotes, the bus factor in this case is 1 and that's horrible.

Where does HN display the downvote count for a post?

You can get a sense for how much a post is being downvoted by the shade of gray the post is displayed with. The closer to white, the more downvotes. HN stopped greying out your own posts, so it's not easy to determine exactly how the behavior is implemented.

Personally, I find the greying of a post on even a single downvote to be quite unfortunate and easily abused. I feel a post should only start greying on the second downvote.

I find it useful and will upvote gray posts that I feel have been downvoted over disagreement rather than truly deserving the downvote. It's probably my most common reason for upvoting.

It’s potentially worth noting that downvoting over disagreement is considered in-line with the rules: https://news.ycombinator.com/item?id=17996858

I don't think downvote counts are shown, even to high-karma posters.