News for hackers. Stuff that matters.

A comment on Starting in August, Google will require that they sign apps, not you. Parent comment

Re:Starting in August, Google will require that they sign ap... by izacus on Sunday May 16, 2021 @06:08PM (#27177490)
There's nothing guaranteeing that Deb contains the same thing as source Deb. At the end of the day you still need to trust the organization building your OS so they don't push a backdoor in your root installed package.
[ Parent | on HN ]
Re:Starting in August, Google will require that they sign ap... by Avamander on Sunday May 16, 2021 @07:44PM (#27178378)
> There's nothing guaranteeing that Deb contains the same thing as source Deb.

That's blatantly understating how many packages are reproducible.

[ Parent | on HN ]
Re:Starting in August, Google will require that they sign ap... by izacus on Monday May 17, 2021 @02:43AM (#27180651)
No it's not - reproducibility doesn't defend you against malicious repository at all. You still need to trust every single maintainer of your packages and the repository owner to not serve you backdoored package.
[ Parent | on HN ]
Re:Starting in August, Google will require that they sign ap... by w4rh4wk5 on Monday May 17, 2021 @08:31AM (#27182704)
Yes and no. Just having reproducibility does not automatically prevent bad things from happening. But it's certainly easier to defend against them.

Multiple people can grab the sources from the developer, review and apply the patches, build the package and publish the resulting hash. With reproducible builds, all people end up with the same hash, which should also be the same for the pre-built package in the repository.

In other words, instead of trusting one single person (the maintainer) you split the trust across multiple people. This is definitely an improvement thanks to reproducible builds.

[ Parent | on HN ]
Re:Starting in August, Google will require that they sign ap... by dbrgn on Sunday May 16, 2021 @06:53PM (#27177881)
This is what reproducible builds try to fix: https://wiki.debian.org/ReproducibleBuilds
[ Parent | on HN ]
Re:Starting in August, Google will require that they sign ap... by sichtlinkair on Sunday May 16, 2021 @06:37PM (#27177713)
> At the end of the day you still need to trust the organization building your OS so they don't push a backdoor in your root installed package.

I am curious what are good solutions to this problem? Compile your OS (and any other software) from source?

[ Parent | on HN ]
Re:Starting in August, Google will require that they sign ap... by content_sesh on Sunday May 16, 2021 @06:45PM (#27177791)
Somewhere a Gentoo maintainer's ears are ringing, but they don't know why...
[ Parent | on HN ]
Re:Starting in August, Google will require that they sign ap... by ex_amazon_sde on Tuesday May 18, 2021 @05:30PM (#27201450)
A backdoor/bugdoor is much more likely to be in the source code. Compiling the code by yourself does not help.

You have to rely on a distribution that has a many-eyes review policy and has security conscious users.

[ Parent | on HN ]
Re:Starting in August, Google will require that they sign ap... by zingplex on Sunday May 16, 2021 @06:35PM (#27177686)
Isn't this exactly why they're doing the reproducible build stuff?
[ Parent | on HN ]
Re:Starting in August, Google will require that they sign ap... by goodpoint on Tuesday May 18, 2021 @05:22PM (#27201345)
No, you can already download the source .debs, rebuild them and compare the results.

And, there are large tech firms doing this already.

[ Parent | on HN ]