Who remembers Ken Thompson's "Reflections on Trusting Trust"?
The norm today is auto-updating, pre-built software.
This places a ton of trust in the publisher. Even for open-source, well-vetted software, we all collectively cross our fingers and hope that whoever is building these binaries and running the servers that disseminate them, is honest and good at security.
So far this has mostly worked out due to altruism (for open source maintainers) and self interest (companies do not want to attack their own users). But the failure modes are very serious.
I predict that everyone's imagination on this topic will expand once there's a big enough incident in the news. Say some package manager gets compromised, nobody finds out, and 6mo later every computer on earth running `postgres:latest` from docker hub gets ransomwared.
There are only two ways around this:
- Build from source. This will always be a deeply niche thing to do. It's slow, inconvenient, and inaccessible except to nerds.
- Reproducible builds.
Reproducible builds are way more important than is currently widely appreciated.
I'm grateful to the nixos team for being beating a trail thru the jungle here. Retrofitting reproducibility onto a big software project that grew without it, is hard work.