Re:VSCodium – Libre Open Source Software Binaries of VS Code
by haolez on Monday September 04, 2023 @02:54PM
(#37383662)
Good point. That's one problem that might be well solved by something like BitTorrent, which hashes all the files as part of the protocol. Once a binary gets analyzed and trusted (the current binary, not the process or every new upgrade), it can be safely used.
Re:VSCodium – Libre Open Source Software Binaries of VS Code
by brnt on Monday September 04, 2023 @04:31PM
(#37384724)
Vscode packaging as/is famously not public. Plus, trust to do what exactly? Come with telemetry flipped on?
Re:VSCodium – Libre Open Source Software Binaries of VS Code
by skybrian on Monday September 04, 2023 @09:01PM
(#37386716)
Trust is always relative to a threat model. I trust that the people who work on VS Code won't do all sorts of nefarious things that hackers might want to do if they can get code running on your system. I trust that their telemetry settings do what they say they'll do. And if someone finds a security bug, they'll fix it.
I don't assume that there won't be security holes, but in effect, I'm assuming they probably won't affect me.
Reproducible builds would help here, like Go did for their newest SDK [1].
This would be particularly true for a fork when the source changes are fairly minimal, since you could just verify the patch.
Linux distros are fairly similar; why do we mostly trust Debian packages? Because there’s an umbrella organization and a process. That’s less true of a standalone organization.
Maybe eventually there will be an umbrella organization that just does reproducible builds, and people will use that to distribute binaries. (And independent verification could keep them honest, like happens with domain registrars.)
[1] https://go.dev/blog/rebuild