71–80 of 182 posts
I hate proof of work code running on my machine for the benefit of someone else. It's like planting a crypto miner.
Reading this, I think low level engineering is actually more dependent on specific environments. Hardware also has its own points of change. Usually, when you think at a high level, environmental changes are less significant than you might expect. But low level thinking tends to be tied to specific environments, which is what makes it difficult. The reason low level is hard is that even if the code itself is short, t…
Earlier quoted context omitted.
Sure, but a signature doesn't prove that a particular binary came from a particular codebase - merely that a particular human (or other trusted entity, for varying degrees of "trusted") has vouched for it. Being able to reproduce the binary from the source code and being able to verify that it's the same as the original is quite important in some contexts.
>Being able to reproduce the binary from the source code and being able to verify that it's the same as the original is quite important in some contexts. I disagree. The contexts that people come up with are purely theoretical, and are not practically important. Please do try and convince me otherwise by sharing such a context. From my view the juice of trying to accomplish this is no where worth the squeeze.
Military context: a government would want to review the code and compile themselves. Provide a hash of the target binary to ensure they've compiled it correctly.
SDLC: provide auditors with _proof_ that the tested binary is indeed coming from the audited code
Earlier quoted context omitted.
The whole point of a signature is that you are able to verify what was signed was in fact a message that was signed by signer.
Sure, but a signature doesn't prove that a particular binary came from a particular codebase - merely that a particular human (or other trusted entity, for varying degrees of "trusted") has vouched for it. Being able to reproduce the binary from the source code and being able to verify that it's the same as the original is quite important in some contexts.
Why not build your own binaries and be done with that. If you don’t trust the compiler or the machine doing the build, just build the code yourself.
Earlier quoted context omitted.
>Being able to reproduce the binary from the source code and being able to verify that it's the same as the original is quite important in some contexts. I disagree. The contexts that people come up with are purely theoretical, and are not practically important. Please do try and convince me otherwise by sharing such a context. From my view the juice of trying to accomplish this is no where worth the squeeze.
You disagree but you're wrong. Military context: a government would want to review the code and compile themselves. Provide a hash of the target binary to ensure they've compiled it correctly. SDLC: provide auditors with _proof_ that the tested binary is indeed coming from the audited code
SDLC: Traceability is more important than reproducibility. Keeping logs is more important than deterministic build outputs
These seem very reasonable, the workarounds used are natural, and overall the article is not at all congruous with the conclusion in the (clickbait?) title? Compilers literally made your project possible!
> Clang relies on address layout for ordering things I would consider that a bug tbh
So to avoid those energy-hungry LLM companies from scraping your website, you force each browser to compute a lot of hashes in a necessarily energy-hungry loop, creating, at the same time, all the kind of accessibility problems?