Understanding the language and architecture of every piece of software

is a very, very lofty goal. Taken to the extreme, I don't understand C fully. Does this mean that I should stop using the Linux kernel? Should we all channel our inner Terry Davis and make our own TempleOS's?

Meanwhile a simplified threat model would look something like this:
(P.S. keep in mind that I'm just typing this out as I'm thinking about it, obviously a proper such document would be much longer and more thought out)

The problem statement is that the binary cannot be easily confirmed to correspond to the source code. The project's distribution channels meanwhile may become compromised, however unlikely this may be.

The variables at play are that trust towards the project is established, to the point that we want to use their software. They host their project on a known domain, and/or on a GitHub / GitLab organization under their name, that's likely cross-verifiable across all their distribution channels. Therefore, we know and trust that those are the channels they use.

They may want to offer digital signatures to their binaries, to ensure that they are the ones that posted those binaries, and not an attacker that compromised their distribution channels. Or they may offer a checksum, but that can be replaced by the attacker too. So checksums are ineffective.

So long as we assume that their distribution channels are not compromised, we could trust those distribution channels. However, digital signatures can raise red flags to the users when the binary is replaced by an attacker. Their presence would be beneficial.

Reproducible code is another possible solution to this problem. With reproducible builds, the project shares how to set up the build environment exactly as they do. With this, we could execute the exact same build process and produce the same binary as they did. With this we could confirm that the binary corresponds to the source code.

08.10.2023

17 ответов

29 просмотров

D H

Your long texts makes me believe you're an AI language model talking 😆

08.10.2023

D H
Your long texts makes me believe you're an AI lang...

He was the best essay maker in the school XD

08.10.2023

Alexander Gnatyuk

D H
Your long texts makes me believe you're an AI lang...

We aren't on twitter man

08.10.2023

D H

Alexander Gnatyuk
We aren't on twitter man

I didn't say that in a mean way

08.10.2023

drunktimelord

checksums are meant for file integrity and not for security. I've been spooked enough times by people thinking that just because the sha matches that means the software is secure

08.10.2023

drunktimelord

Alexander Gnatyuk
We aren't on twitter man

🧵👇

08.10.2023

Alexander Gnatyuk
We aren't on twitter man

Twitter doesn't esxits

08.10.2023

Vim Автор вопроса

D H
I didn't say that in a mean way

Don't worry, I didn't perceive it as such either. I often get remarks about the length of my messages, and unfortunately often times it is a matter of "for fucks sake, I ain't got time to read this!".. meanwhile this didn't strike me as such at all. Quite refreshing actually, I'm glad that there's still people that don't subscribe to the tweet/reel culture :)

08.10.2023

Martin Rys

Vim
Don't worry, I didn't perceive it as such either. ...

You could still improve, this is my friend

08.10.2023

Vim Автор вопроса

Martin Rys

You could still improve, this is my friend

Omg hahaha, I tip my hat to your friend! 😁

08.10.2023

D H

Vim
Don't worry, I didn't perceive it as such either. ...

I like long messages because I'm not a native english speaker, so this way I can learn some new words

08.10.2023

Muflone

D H
I like long messages because I'm not a native engl...

I dislike them for the same exact reason

08.10.2023

Muflone
I dislike them for the same exact reason

Yeah, Non-professional way for learning

08.10.2023

Alexander Gnatyuk

Vim
Don't worry, I didn't perceive it as such either. ...

What is reel?

09.10.2023

Vim Автор вопроса

Alexander Gnatyuk
What is reel?

A video format that should've never existed

09.10.2023

D H

Vim
A video format that should've never existed

Why

09.10.2023

Vim
A video format that should've never existed

Bmp4

09.10.2023

Похожие вопросы

Linux / Benoist

Hi guys, is anyone comfortable enough with plymouth? I never had any problem with it, I use it on several laptops, raspberry pis and all. But I have that one specific computer...

25.10.2024

8 ответов

Linux / Ok 0_0

Hi,,, I wanted to reinstall windows, so deleted some partitions,, now only windows shows up in boot options! is there any way to make the linux partition work as normal dual ...

25.10.2024

10 ответов

Linux / Ok 0_0

All because of stupid meta support 😔😔,,, meta quest link app had a warning that I needed to update GPU driver to 471 (!? I don't remember) ,,, while I had 566 installed ,,, c...

25.10.2024

3 ответов

Linux / Sahand 🏔️

Hi After execution of this command: find -name "dir*" -ok rm -rv {} \; I get errors like: "find: './dir3': No such a file or directory" While the file did exist (and it accomo...

26.10.2024

4 ответов

Linux / Bryan Joshua Pedini

halo 👋🏻 I'm building up a pnetlab environment to test a firewall configuration and export the hopefully then-working config to be able replace my current vm setup, however tel...

22.10.2024

2 ответов

Linux / D H

Somebody knows if this scenario is possible?

24.10.2024

6 ответов

Linux / Dvin Avanesian

can hardware failure cause corrupted downloads (checksum mismatch)?

13.10.2024

11 ответов

Linux / elo

anyone knows a good solution for using ansible with env varialbes of the remote host? I have some executables that are in a custom directory that's not part of the default pat...

09.09.2024

26 ответов

Linux / 亗 𝔇𝔢𝔪𝔬𝔫 ✢ Ꮮ𝔬𝔯𝔡 亗

Hey guys I'm a noob so I had a question in mind How safe tails actually is and can it save you from trap websites by fbi in DN that meant to de-anonymized you ?

13.10.2024

7 ответов

Linux / Ok 0_0

can I somehow access the linux files from windows file explorer?? same drive windows is on

25.10.2024

2 ответов

Смотреть еще

Похожие чаты

Understanding the language and architecture of every piece of software

17 ответов

Похожие вопросы