Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TunnelBear Publishes Security Audit

tunnelbear.com

Post reply on HN
Print view View original

1–10 of 61 posts

Re: TunnelBear Publishes Security Audit

#2

Post by huhtenberg »

Can official binaries be independently reproduced from published sources by members of the public?

If no, then an audit has little to no value as it still implies trusting the vendor not to fudge the binaries or, more broadly, be malicious.

Re: TunnelBear Publishes Security Audit

#5

Post by lfam »

huhtenberg wrote: post #2

Can official binaries be independently reproduced from published sources by members of the public? If no, then an audit has little to no value as it still implies trusting the vendor not to fudge the binaries or, more broadly, be malicious.

I think your judgment is too harsh.

Very few software deployment systems make it possible for binaries to be independently reproduced from published sources by the public. AFAIK, it's limited to systems like Nix, Guix, recent Debian, and other participants in the Reproducible Builds project.

However, even within those systems, if you are downloading a compiled binary instead of building it yourself, how can you be sure that you get the "right" binary every time? Does the binary download system periodically "challenge" the binary provider by building from source and comparing with the downloaded binary? If so, does it report its findings anywhere?

It seems to me that even within a software deployment system that enables users to reproduce binaries, you still end up trusting whoever runs the deployment system, because there are no methods of challenging the reproducibility in a meaningful way. The systems I mentioned above sign the binaries, which means that you implicitly trust the holder of the signing key to send you the right binary. But it doesn't mean anything about the relationship of the binary to some source code.

Having said that, if I am using some program by downloading binaries, I am trusting whoever provides the binaries. If I trust them, then a source code audit is valuable to me, even though I can't be sure the compiled binary is related to the source code.

Re: TunnelBear Publishes Security Audit

#6

Post by burkaman »

huhtenberg wrote: post #2

Can official binaries be independently reproduced from published sources by members of the public? If no, then an audit has little to no value as it still implies trusting the vendor not to fudge the binaries or, more broadly, be malicious.

Little to no value? There's a pretty big gap between trusting a vendor to not lie and trusting them to not make mistakes.

Re: TunnelBear Publishes Security Audit

#7

Post by huhtenberg »

burkaman wrote: post #6
huhtenberg wrote: post #2

Can official binaries be independently reproduced from published sources by members of the public? If no, then an audit has little to no value as it still implies trusting the vendor not to fudge the binaries or, more broadly, be malicious.

Little to no value? There's a pretty big gap between trusting a vendor to not lie and trusting them to not make mistakes.

It's a moot point for a security vendor to establish its competence without establishing its trustworthiness.

Re: TunnelBear Publishes Security Audit

#8

Post by brndnmtthws »

TunnelBear is a great product, one which I've been using for a few years, and I trust them with my business. I wish services like Netflix didn't blacklist their IPs, but it's easy enough to get content off alternative sites when I'm traveling outside the US.

Thanks for the good work!

Re: TunnelBear Publishes Security Audit

#9

Post by huhtenberg »

lfam wrote: post #5
huhtenberg wrote: post #2

Can official binaries be independently reproduced from published sources by members of the public? If no, then an audit has little to no value as it still implies trusting the vendor not to fudge the binaries or, more broadly, be malicious.

I think your judgment is too harsh. Very few software deployment systems make it possible for binaries to be independently reproduced from published sources by the public. AFAIK, it's limited to systems like Nix, Guix, recent Debian, and other participants in the Reproducible Builds project. However, even within those systems, if you are downloading a compiled binary instead of building it yourself, how can you be su…

There's NO value in 3rd party vouching for the security (read, quality) of some specific version of the software, because this opinion will be rendered null and void with the next software update.

There is some value in 3rd party verifying the system design (the architecture, the protocol, etc.) and general engineering practices in the company, but this still hinges on the need to trust this company not to be (or being coerced to be) malicious. TunnelBear hasn't established the latter, so - yes, there's little to no value in former. There is some marketing value in it though.

PS. Zimmerman's original secure VoIP project was rooted in the idea of reproducible builds. It was open source, but with a license that prohibited any use except for verifying binary builds. It was 20 (?) years ago.

Post reply on HN