>We almost had a major backdoor in OpenSSH deployed worldwide, caught at the 11th hour.
Which was not caught by any of the reproducible work people had done. Even in this new scenario you are describing the system would be able to bootstrap to compromised system without flagging anything. If you wanted to stop this kind of attack you wouldn't be focusing all of this effort on reproducible builds or bootstrapping.
The XZ attack was not in version control. It was on the human-built tar files published to Github Releases which no one reviews. Trust in a single person. Distros paranoid about supply chain attacks like stagex build directly from (ideally well reviewed) VCS snapshots for all modern software.
Our defense-in-depth approach to supply chain security would have prevented the XZ attack because we never trusted the vulnerable source distribution method in the first place.
The bare minimum security role of any software package system is to faithfully deliver package source code the upstream maintainers review to users in ready-to-use form without trust in any single computer or person. Sadly no Linux distro hits this bar (except stagex!), so this is a very bad day waiting to happen.
I thought the attack itself was version controlled via a tracked blob file used in a unit test. I believe the attack was performed by running the test suite (which modified the source code) and then compiling?
If that's the case, then anyone that ran the tests prior to building from source would be vulnerable if my understanding is right
It was in the uploaded tar.gz file to the releases page. The vulnerable code bypassed code review, at least for those distros that trusted the human made source snapshots more than git which was a poor choice.
The threat actor had access to the source control so he could have just as easily put it there too. Even if you caught it by being so diligent about reviewing it (not many people are in practice), it would not have been caught due to the reproducible builds or bootstrapping work.
> The threat actor had access to the source control so he could have just as easily put it there too.
And yet they did not because that would be much much higher risk of getting caught, given lots of people pay attention to high-performance-impact code like xz changing, and it would have been obvious in code review .He had to hide it and take advantage of distros being lazy about supply chain trust and modify the code -after- review.
Most supply chain attacks in the clear are detected.
Suffice to say, it was viable defense for this attack before anyone had seen it used before, that worked as intended.
Security engineering is about preventing attacks before they happen. If we normalize full source bootstrapped deterministic and quorum signed builds, then the internet is no longer vulnerable to a $5 wrench attack like it is right now.
So much time has been wasted by the open source community on pointless projects like this.
>Reproducible builds allow people to "have more confidence that the binary you are using, which is actually executing on the computer, corresponds to the source code".
The developer signing the build provides sufficient guarantees. Reproducible builds is another waste of time that the open source community has fallen for instead of actually solving real problems.
>Bootstrappable builds can prevent the kinds of problems that Ken Thompson described in his famous Turing Award lecture: Reflections on Trusting Trust.
So much time is being spent on a theoretical problem. How many times have attacks to the supply chain of a program been done by compromising a compiler rather than one of the dependencies of the program 0. Why is time being spent on attacks which have never shown up in the wild?
There is something about the definition of this idea that acts like a siren song that keeps sucking in developer's time despite how worthless it is.
I can only guess the people painting targets on their backs that big are woefully unaware of it, or living in deep survivors bias.
Trusting control of the entire internet to the laptop memory holding the PGP signing key that signs debian packages of GCC was always an insane thing to do, and still is.
Imagine what happens when one of those maintainers decides they like bribes or do not like being hit with rubber hoses.
Quorum signing of full source bootstrapped deterministic builds completed on independently owned and geo-distributed hardware produced by different vendors is currently the only viable solution to greatly reduce the incentive to coerce maintainers.
Sure it does, if you deterministically full source bootstrap, build, and sign the same image m-of-n places with different hardware owned by different people, all of whom only sign if everyone gets identical results, and this can be easily verified with remote attestation at runtime on a running server.
We can cryptographically attest with high confidence what code is running on a remote server at any given moment with these tactics. Entire classes of attacks are taken off the table with this approach, including BGP attacks if deployed properly.
Just for perspective, the people working on his are pursuing their hobbies and sharpening their programming skills. In contrast, you are using your time to whine about it on the internet.
People can still pursue their hobbies and sharpen their programming skills by working on more productive issues that exist. While you could call my comment whining, if it is able to change maybe even one person's opinion on the utility of this work it could help lead to a bigger reprioritization of people's time allowing for more important issues that affect real users to be addressed instead.
>People can still pursue their hobbies and sharpen their programming skills by working on more productive issues that exist.
No, they can't.
People pursue things that interest them, if it isn't interesting they wouldn't do it at all.
This is similar to "why donate to cause X when cause Y is much more important?" well if cause X didn't exist, those people likely wouldn't donate at all, so it's not really an opportunity cost.
Except I'm not saying there is only X and Y. I'm saying there is AAAAA-ZZZZZ and people working on problem XYZAB would be able to help actually push these operating systems forward if they chose another problem they also found interesting. I do not believe that it is only possible for these people to be interested in a single problem. I think these people can be motivated to find another problem more interesting.
This project is not pointless at all. It's not about "reproducible builds", but about building a full present system from "first principles". It would be a way out of a significant dependability problem barely anyone today is aware of.
It's not my problem. It's not anyone's problem. That's my point. It's also not something that's a little further beyond the horizon or the next weakest link that attackers may target next.
I have developing software in C(++) since 1990, but I did learn some new things about the language when developing a C compiler for a live-bootstrap variant not using the GNU Mes compiler.
This thinking keeps open source behind competitors. Additionally this person is not just wasting his own time, but through both just this talk and the contents of it where he asks others for help it is causing other people to get involved with this waste of time.
You seem to be missing the part where this is all people voluntarily doing things that they deem are important to themselves or just plain fun to do.
No one commands open source developers to do the things they do, they do them because they have an itch to scratch and are kind enough to release that work for other people with the same itch.
Your view is very much "What I think they should do is more important than what they think they should do" and that's not how that works.
There are more itches for these people to scratch than this problem. Volunteer's time is both valuable and limited and it is a shame when it is wasted when those resources could have been used on something that actually makes the product better.
>"What I think they should do is more important than what they think they should do" and that's not how that works.
Again within his talk he is trying to get people to work on what he thinks is important instead of what they would otherwise be doing. Is he entitled for that? I don't think so. Trying to align people with your vision to try and accomplish things is just a part of life and I do not see it as entitlement. Society is one big optimization problem and arguments like this is a part of how the optimization process works.
This is probably not a convincing argument, but I'll share it anyway.
Think of bootstrapable builds as a hedge against tyranny.
Is it likely that a future regime could come into being that would be backdooring FLOSS builds and undermining confidence in the entire ecosystem? Not at all likely, as this requires a purge of all the install/boot media already out there.
Though after the passage of decades, the chain of custody starts to weaken. Maybe I'll still believe in the magic of the CD in my retro closet with the three humans holding hands in a circle, but in an environment where children are told to report the thoughtcrimes of their elders, how can my nephews and nieces in turn trust me and my testimony that my copy is the "good stuff" from "the before times".
This is all very far fetched sci-fi material, but think in terms of tail risk, low probability multiplied by a high cost if comes to pass.
Perhaps a regime horrible enough to break FLOSS would be horrible enough to purge all legacy hardware and software sitting in closets, but I do think it is easier to mess up the internet and the social fabric than it is to do house to house cleanouts.
Maybe messing around with untainted FLOSS will be too dangerous in such an environment anyway, but if we can assume a state of liberty eventually returns, having a great bootstrap ready to go can help rebuild society, cyberspace, and trust on an accelerated basis.
All of this hinges on people actually auditing source code, though once you've read enough bootstrapped source to have confidence in the generation of checksums you can at least start to fall back on a social consensus as to the safety of additional source archives that have known checksums and from there also digital signatures once you've built the tools for validating those.
When it comes to "trust, but verify" of other people's source code, there is a new tool in the toolbox: large language models have demonstrated some considerable audit value. Of course almost nobody is training their own models and it's only a slightly larger circle that does inference on their own hardware or attested remote hardware, but all of this is at least something that can increase confidence when working from other folks source code.
-------
As far fetched as full on cyber tyranny sounds, its worth remembering that in North Korea this is actually reality. Folks do not have access to the internet and are handed the state built binary of Red Star OS.
The ballooning of flash drives containing western media is still a thing despite attempts to stop it.
It is unlikely that anyone will ever send in a software bootstrap, that it will get in the hands of someone who can understand it, have the time to read it and build it.
But the scenario does make us think about the value of bootstrapable FLOSS as a tyranny hedge.
Without real internet access, what good does having some freedom on a computer even do? I suppose one can keep a diary encrypted, though possessing an encrypted file is probably more of a liability than any value it provides. Someone may also find encryption helpful for friend to friend networks by sneakernet, though the downsides are considerable.
Someway, somehow the regime may fall. After decades of not trusting the outside world and being governed by a hostile state, perhaps there will be at least one deeply computer literate person to emerge from that place who will appreciate being able to bootstrap their own personal cyber citadel.
This can be solved easier by having a known good Linux distribution that you make a million copies of. There is no need to start from absolute scratch if you are scared of open source code being wiped from the internet.
>Every Suica card has a chip storing two things: a unique card ID, and your current balance.
This is not true. It also stores some history on where you have last entered so it can do things like transfers or block you from exiting an area that you never entered.
None of the original source code exists in these projects. It’s all created from scratch.
Copyright for this new code is owned by the person doing decompilation. No one knows how similar to the original it is or not, just that it compiles to the same output.
Edit to clarify: by not exist, I mean it is not publicly available.
It's not an obvious legal argument that it is not a derivative work of the compiled code or the original source code that produced that. Clean room reverse engineering is meant to give you a strong argument for that, and while it's not necessarily required to prevail against a copyright case (or actually sufficient) it's gonna make things harder if you don't. (All of this is made more murky because copyright is meant to only cover expressions of human creativity, and code is kind of a mix of creativity and mechanical details: the clean room approach is meant to separate out the mechanical details)
Also, If it is an unauthorized derivative work, as I understand it then it might not even qualify for copyright protection itself.
A decompilation is not clean room, nor is it "created from scratch". If that was the case, you could just compile a program to remove the copyright, because the machine code doesn't resemble the source code at all either.
A reimplementation or a behavior-based clone is an entirely different legal world from decompilation.
The compiled binary is protected and the property of the original company. The source code written by people doing decompilation is owned by the people doing the decompilation. That source code can compile to a lot of different binary representations, just like a lot of code representations (infinitely many) could compile to the original binary.
In fact, the goal of most decomp not to produce the same binary, that’s just used as a validation.
Historically these projects have gone to match byte for byte recreations which ensures that they are derivative works making them infringing copyright.
Obviously, a problem not even fully addressed by L2’s datasets. Sure, but the use of proxies to masquerade the identity of users being sold to researcher buyers that paid for a different service is fraud
Users/respondents lie, and many buyers/researchers are neo-luddites; most C level still come from the telemarketing days. A fun example: mobile targeting is terrible when off wifi because all survey platforms uniq identify users based off their IPv4, so any T-Mobile LTE users in the same city going through the same CGNAT often share profiling data that ends up conflicting, which ends up meaning they don't get sent into the best survey(s). The issue is even worse in heavy IPv6 countries like India+France.
Yes. Much better to leave these decisions to the Dear Leader who is infinitely wise and cannot be misled. Or to the People's Central Planning Committee, where they decide all the allocations and strip rich people's wealth if they aren't on board with the correct ideology. Such systems are non-broken and have yielded unmeasurable prosperity throughout the world wherever implemented.
The idea is that the "same wage" you are talking about is too low to hire enough employees in the time needed that the company needed so they had to look abroad for people willing to work for that amount.
reply