News for hackers. Stuff that matters.
Re:You don’t need reproducible builds by chii on Wednesday August 05, 2020 @08:07AM (#24059904)
but this just shifts the burden of who to trust to the verifiers. It didn't make the software from the vendor _any more_ trustworthy.
Re:You don’t need reproducible builds by strbean on Wednesday August 05, 2020 @02:21PM (#24063886)
It shifts and distributes the burden of trust. There are mountains of scenarios where we shift from "we rely on trusting this one person / entity" to "we rely on trusting at least one of these N people / entities", and that is a huge win every time.
Re:You don’t need reproducible builds by ENOTTY on Wednesday August 05, 2020 @08:15AM (#24059950)
> this just shifts the burden of who to trust to the verifiers

Agreed. A colleague once said that trust is like a balloon; if you reduce trust in one area, you tend to expand trust in another area.

I think the typical response to your statement from a user is that it’s easier to trust a set of verifiers than it is to trust a vendor. The act of a verifier blessing an artifact makes that artifact more trustworthy.

Personally I’m skeptical of these claims, but that’s the underlying assumption of the certification process

Re:You don’t need reproducible builds by ta8594505930 on Wednesday August 05, 2020 @08:38AM (#24060132)
Presumably there is benefit in reducing trust in a party with mixed or unknown incentives to increase trust in a party whose incentives align with your own. For a critical piece of software I could imagine a schema where a user pays one or more independent verifiers to validate the software. That would allow the user to control the incentives of the entities telling them the software is safe.
Re:You don’t need reproducible builds by ummonk on Wednesday August 05, 2020 @03:27PM (#24064544)
No, because now you don’t have to trust any one entity completely. You just have to trust that at least one of the verifiers is uncompromised.