You don’t need reproducible builds

Re:You don’t need reproducible builds by ENOTTY on Wednesday August 05, 2020 @08:15AM (#24059950)

> this just shifts the burden of who to trust to the verifiers

Agreed. A colleague once said that trust is like a balloon; if you reduce trust in one area, you tend to expand trust in another area.

I think the typical response to your statement from a user is that it’s easier to trust a set of verifiers than it is to trust a vendor. The act of a verifier blessing an artifact makes that artifact more trustworthy.

Personally I’m skeptical of these claims, but that’s the underlying assumption of the certification process

[ Parent | on HN ]

Re:You don’t need reproducible builds by ta8594505930 on Wednesday August 05, 2020 @08:38AM (#24060132)

Presumably there is benefit in reducing trust in a party with mixed or unknown incentives to increase trust in a party whose incentives align with your own. For a critical piece of software I could imagine a schema where a user pays one or more independent verifiers to validate the software. That would allow the user to control the incentives of the entities telling them the software is safe.

[ Parent | on HN ]