I wonder what else other than disorderfs they could throw in to flush out additional currently hidden non-determinism.
Nixos-unstable’s ISO_minimal.x86_64-Linux is 100% reproducible
121–130 of 232 posts
Re: Nixos-unstable’s ISO_minimal.x86_64-Linux is 100% reproducible
#122Earlier quoted context omitted.
No. I can review 0.1% of the code and verify that it compiles correctly and then let another 999 people review their own portion. It only takes one person to find a bit of malicious code, we don’t all need to review every single line.
That only works if you coordinate. With even more people, you can pick randomly and be relatively sure you've read it all, but I posit that 1) you don't pick randomly, you pick a part that is accessible or interesting to you (and therefore probably others) and 2) reading code locally is not sufficient to find bugs or backdoors in the whole.
The crev folks are working on a co-ordination system for incremental distributed code review:
Re: Nixos-unstable’s ISO_minimal.x86_64-Linux is 100% reproducible
#123Earlier quoted context omitted.
> I predict that everyone's imagination on this topic will expand once there's a big enough incident in the news. How the Solarwinds incident, with about every large software vendor being silently compromised for years does not qualify? Because it does not, people's imagination is as closed as it always was.
Solarwinds is closed source so the choice to build from source is not really an option.
They could have distributed the code to a few select parties for the purposes of doing a build and nothing more.
Re: Nixos-unstable’s ISO_minimal.x86_64-Linux is 100% reproducible
#124This really deserves more love. Who remembers Ken Thompson's "Reflections on Trusting Trust"? The norm today is auto-updating, pre-built software. This places a ton of trust in the publisher. Even for open-source, well-vetted software, we all collectively cross our fingers and hope that whoever is building these binaries and running the servers that disseminate them, is honest and good at security. So far this has mo…
Supply chain attacks are definitely important to deal with, but defense-in-depth saves us in the end. Even if a postgres container is backdoored, if the admins put postgres by itself in a network with no ingress or egress except the webserver querying it, an attack on the database itself would be very difficult. If on the other hand, the database is run on untrusted networks, and sensitive data kept on it... yeah, th…
In the case of a supply chain attack, you don't even need ingress or egress.
Say the posgres binary or image is set to encrypt the data on a certain date. Then it asks you to pay X ZEC to a shielded address to get your decryption key. This would work even if the actual database was airgapped.
Re: Nixos-unstable’s ISO_minimal.x86_64-Linux is 100% reproducible
#125Earlier quoted context omitted.
> I'm grateful to the nixos team for being beating a trail thru the jungle here. Retrofitting reproducibility onto a big software project that grew without it, is hard work. Actually, it's Debian guys who pushed reproducible build hard in the early days. They upstreamed necessary changes and also spread the concept itself. This is a two-decade long community effort. In turn, NixOS is mostly just wrapping those projec…
Has a full linux image--something you can actually boot--existed as a reproducible build before today?
Forgive my ignorance but isn’t that Slackware?
Re: Nixos-unstable’s ISO_minimal.x86_64-Linux is 100% reproducible
#126Earlier quoted context omitted.
Unless you are going to be the equivalent of a full time maintainer doing code review for every piece of software you use you need to trust other software maintainers reproducible builds or not. Considering this is Linux and not even Linus can deeply review every change in just the kernel anymore that philosophy can't apply to meaningfully large software like Nixos.
No. I can review 0.1% of the code and verify that it compiles correctly and then let another 999 people review their own portion. It only takes one person to find a bit of malicious code, we don’t all need to review every single line.
> It only takes one person to find a bit of malicious code, we don’t all need to review every single line.
This is just objectively wrong. I have worked on projects at FAANG where entire teams did not spot critical security issues during review.
You are very unlikely to spot an issue with just one pair of eyes. You need many if you want any hope of catching bugdoors.
Re: Nixos-unstable’s ISO_minimal.x86_64-Linux is 100% reproducible
#127This really deserves more love. Who remembers Ken Thompson's "Reflections on Trusting Trust"? The norm today is auto-updating, pre-built software. This places a ton of trust in the publisher. Even for open-source, well-vetted software, we all collectively cross our fingers and hope that whoever is building these binaries and running the servers that disseminate them, is honest and good at security. So far this has mo…
Why does building from source help? It’s not like people are reading every line of the source before building it anyway 99.99% of the time.
If the package maintainer's build pipeline is compromised (eg. Solarwinds), you are unlikely to be affected if you build from reviewed source yourself.
Re: Nixos-unstable’s ISO_minimal.x86_64-Linux is 100% reproducible
#128This really deserves more love. Who remembers Ken Thompson's "Reflections on Trusting Trust"? The norm today is auto-updating, pre-built software. This places a ton of trust in the publisher. Even for open-source, well-vetted software, we all collectively cross our fingers and hope that whoever is building these binaries and running the servers that disseminate them, is honest and good at security. So far this has mo…
> Reproducible builds are way more important than is currently widely appreciated.
Why? How will this help with the problems you're talking about?
I can't come up with a single benefit to security from reproducible builds. It seems nice for operational reasons and performance reasons though.
Re: Nixos-unstable’s ISO_minimal.x86_64-Linux is 100% reproducible
#129This really deserves more love. Who remembers Ken Thompson's "Reflections on Trusting Trust"? The norm today is auto-updating, pre-built software. This places a ton of trust in the publisher. Even for open-source, well-vetted software, we all collectively cross our fingers and hope that whoever is building these binaries and running the servers that disseminate them, is honest and good at security. So far this has mo…
> I'm grateful to the nixos team for being beating a trail thru the jungle here. Retrofitting reproducibility onto a big software project that grew without it, is hard work. Actually, it's Debian guys who pushed reproducible build hard in the early days. They upstreamed necessary changes and also spread the concept itself. This is a two-decade long community effort. In turn, NixOS is mostly just wrapping those projec…
I don't think NixOS is getting too much credit. This is an accomplishment, even if it was built on the shoulders of giants.
Re: Nixos-unstable’s ISO_minimal.x86_64-Linux is 100% reproducible
#130This might be a dumb question but what’s a reproducible build
The ability to recreate a binary image from the same set of source files and getting that binary to be identical to the package-provided binary.
This is useful form of ensuring that nothing is amiss during compile/link time.
Today’s GNU toolchain clutters the interior of binary files with random hash values, full file path (that you couldn’t recreate … easily), and random tmpfile directories.
The idea is to make it easier to verify a binary, compare it with earlier-built-but-same-source binary, or to be able to reverse engineering it (and catch unexpected changes in code).