Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nixos-unstable’s ISO_minimal.x86_64-Linux is 100% reproducible

discourse.nixos.org

Post reply on HN
Print view View original

31–40 of 232 posts

Re: Nixos-unstable’s ISO_minimal.x86_64-Linux is 100% reproducible

#31

Post by jnxx »

delroth wrote: post #29
jnxx wrote: post #23

A good sign that the friendly competition by Guix has a positive influence :) https://guix.gnu.org/manual/en/html_node/Bootstrapping.html https://guix.gnu.org/en/blog/2020/guix-further-reduces-boots...

This smaller bootstrap seed thing is a different problem from reproducible builds. nixpkgs does still have a pretty big initial TCB (aka. stage0) compared to Guix. But as far as I can tell NixOS has the upper hand in terms of how much can be built reproducibly (aka. the output hash matches across separate builds).

Bootstrapping from a very small binary core (I think 512 bytes) with an initial C compiler written in Scheme also has the advantage that the system can easily be ported to different hardware. Which is one major strength of the GNU projects and tools.

Re: Nixos-unstable’s ISO_minimal.x86_64-Linux is 100% reproducible

#32

Post by jnxx »

zamadatix wrote: post #28
jnxx wrote: post #27

Earlier quoted context omitted.

That's too black-and-white. Being able to reproduce stuff makes some kind of attacks entirely uninteresting because malicious changes can be traced back. Which is what many types of attackers do not want. Debian, or the Linux kernel, for example, are not fool-proof, but both are in practice quite safe to work with.

Who are you going to trace it back to if not the maintainer anyways? If the delivery method then why is the delivery of the source from the maintainer inherently any safer?

No, it is not always the maintainer. Imagine you download a binary software package via HTTPS. In theory, the integrity of the download is protected by the server certificate. However, it is possible that certificates get hacked, get stolen, or that nation states force CAs to give out back doors. In that case, your download could have been changed on the fly with arbitrary alterations. Reproducible builds make it possible to detect such changes.

Re: Nixos-unstable’s ISO_minimal.x86_64-Linux is 100% reproducible

#33

Post by jnxx »

quarantine wrote: post #30
jnxx wrote: post #25

Earlier quoted context omitted.

This is great! The one fly in the ointment, pardon, is that Nix is a bit lax about trusting proprietary and binary-only stuff. It would be great if there were a FLOSS-only core system for NixOS which would be fully transparent.

Nix/Nixpkgs blocks unfree packages by default, so I presume it would be relatively easy to disable packages with the `unFree` attribute.

I totally believe it is possible, it is perhaps more of a cultural thing.

Re: Nixos-unstable’s ISO_minimal.x86_64-Linux is 100% reproducible

#35

Post by eptcyka »

zamadatix wrote: post #28
jnxx wrote: post #27

Earlier quoted context omitted.

That's too black-and-white. Being able to reproduce stuff makes some kind of attacks entirely uninteresting because malicious changes can be traced back. Which is what many types of attackers do not want. Debian, or the Linux kernel, for example, are not fool-proof, but both are in practice quite safe to work with.

Who are you going to trace it back to if not the maintainer anyways? If the delivery method then why is the delivery of the source from the maintainer inherently any safer?

Even if the original attack happened upstream, if the upstreamed piece of software was pinned via git, then it'd be trivial to bisect the upstream project to find the culprit.

Re: Nixos-unstable’s ISO_minimal.x86_64-Linux is 100% reproducible

#36

Post by radicalcentrist »

dcposch wrote: post #11

This really deserves more love. Who remembers Ken Thompson's "Reflections on Trusting Trust"? The norm today is auto-updating, pre-built software. This places a ton of trust in the publisher. Even for open-source, well-vetted software, we all collectively cross our fingers and hope that whoever is building these binaries and running the servers that disseminate them, is honest and good at security. So far this has mo…

Reproducibility is necessary, but unfortunately not sufficient, to stop a "Trusting Trust" attack. Nixpkgs still relies on a bootstrap tarball containing e.g. gcc and binutils, so theoretically such an attack could trace its lineage back to the original bootstrap tarball, if it was built with a compromised toolchain.

Re: Nixos-unstable’s ISO_minimal.x86_64-Linux is 100% reproducible

#37

Post by solarkraft »

That is a pretty big deal.

This means everyone building NixOS will get the exact same binary, meaning you can now trust any source for it because you can verify the hash.

It’s a huge win compared to the current default distribution model of “just trust these 30 american entities that the software does what they say it does”.

Big congratulations to the team.

Re: Nixos-unstable’s ISO_minimal.x86_64-Linux is 100% reproducible

#38

Post by zamadatix »

jnxx wrote: post #32
zamadatix wrote: post #28

Earlier quoted context omitted.

Who are you going to trace it back to if not the maintainer anyways? If the delivery method then why is the delivery of the source from the maintainer inherently any safer?

No, it is not always the maintainer. Imagine you download a binary software package via HTTPS. In theory, the integrity of the download is protected by the server certificate. However, it is possible that certificates get hacked, get stolen, or that nation states force CAs to give out back doors. In that case, your download could have been changed on the fly with arbitrary alterations. Reproducible builds make it pos…

Same as when you download the source instead of the binary and see it reproducibly builds the backdoored binary. And at this point we're back to "Build from source. This will always be a deeply niche thing to do. It's slow, inconvenient, and inaccessible except to nerds." anyways.

It's not that reproducible builds provide 0 value it's that they don't truly solve the trust problem as initially stated. They also have non-security value to boot which is often understated compared to the security value IMO.

Re: Nixos-unstable’s ISO_minimal.x86_64-Linux is 100% reproducible

#39

Post by eptcyka »

jnxx wrote: post #33
quarantine wrote: post #30

Earlier quoted context omitted.

Nix/Nixpkgs blocks unfree packages by default, so I presume it would be relatively easy to disable packages with the `unFree` attribute.

I totally believe it is possible, it is perhaps more of a cultural thing.

It's the pragmatic thing. I wouldn't use nixOS if I wasn't able to use it on a 16 core modern desktop. I don't think there's a performant and 100% FLOSS compatible computer that wouldn't make me want to gouge my eyes out with a rusty spoon when building stuff for ARM.

Re: Nixos-unstable’s ISO_minimal.x86_64-Linux is 100% reproducible

#40

Post by hsbauauvhabzb »

dcposch wrote: post #11

This really deserves more love. Who remembers Ken Thompson's "Reflections on Trusting Trust"? The norm today is auto-updating, pre-built software. This places a ton of trust in the publisher. Even for open-source, well-vetted software, we all collectively cross our fingers and hope that whoever is building these binaries and running the servers that disseminate them, is honest and good at security. So far this has mo…

I don’t have the resources to audit every component of my system. I favour enterprise distros who audit code which ends up in their repos and avoid pip, npm, etc. but there are some glaring trade offs on both productivity and scalability.

The problem is unmaintainability, I can’t imagine it’d be easier for medium sized teams where security isn’t a priority, either.

Post reply on HN