Re: Risks of deterministic builds

2021-04-19 Thread Jean Louis
* Jan Nieuwenhuizen [2021-04-14 11:27]: > Jean Louis writes: > > > * Jan Nieuwenhuizen [2021-04-08 16:43]: > >> Martin writes: > >> > >> > Maybe freedom in "free software" shouldn't require from the code to be > >> > open neither. Let's just blindly trust some saint developers who > >> >

Re: Risks of deterministic builds

2021-04-14 Thread Jan Nieuwenhuizen
Jean Louis writes: > * Jan Nieuwenhuizen [2021-04-08 16:43]: >> Martin writes: >> >> > Maybe freedom in "free software" shouldn't require from the code to be >> > open neither. Let's just blindly trust some saint developers who >> > cannot even control their own binaries. Actually today we are

Re: Risks of deterministic builds

2021-04-13 Thread Jean Louis
* Jan Nieuwenhuizen [2021-04-08 16:43]: > Martin writes: > > > Maybe freedom in "free software" shouldn't require from the code to be > > open neither. Let's just blindly trust some saint developers who > > cannot even control their own binaries. Actually today we are closer > > and closer to

Re: Risks of deterministic builds

2021-04-12 Thread Jean Louis
* Jan Nieuwenhuizen [2021-04-08 23:47]: > Jean Louis writes: > > > * Jan Nieuwenhuizen [2021-04-08 16:43]: > >> Martin writes: > > > > From https://bootstrapping.miraheze.org/wiki/Stage0 > > > >> Design > > > >> Stage0 starts with only 1 thing: > > > >> 1) A sub 500 byte hex monitor [How you

Re: Risks of deterministic builds

2021-04-12 Thread Jean Louis
* Jan Nieuwenhuizen [2021-04-08 23:40]: > >> The bootstrappable project, GNU Mes and GNU Guix are working to fix that > >> > >> > >> https://guix.gnu.org/en/blog/2020/guix-further-reduces-bootstrap-seed-to-25/ > >> https://fosdem.org/2021/schedule/event/gnumes/ > > > > Janneke, that is

Re: Risks of deterministic builds

2021-04-09 Thread Jan Nieuwenhuizen
Jean Louis writes: > * Jan Nieuwenhuizen [2021-04-08 16:43]: >> Martin writes: > > From https://bootstrapping.miraheze.org/wiki/Stage0 > >> Design > >> Stage0 starts with only 1 thing: > >> 1) A sub 500 byte hex monitor [How you create it is up to you; I like >> toggling it in manually myself]

Re: Risks of deterministic builds

2021-04-09 Thread Jean Louis
* Jan Nieuwenhuizen [2021-04-08 16:43]: > Martin writes: > > > Maybe freedom in "free software" shouldn't require from the code to be > > open neither. Let's just blindly trust some saint developers who > > cannot even control their own binaries. Actually today we are closer > > and closer to

Re: Risks of deterministic builds

2021-04-09 Thread Jan Nieuwenhuizen
Jean Louis writes: > * Jan Nieuwenhuizen [2021-04-08 16:43]: >> Martin writes: >> >> > Maybe freedom in "free software" shouldn't require from the code to be >> > open neither. Let's just blindly trust some saint developers who >> > cannot even control their own binaries. Actually today we are

Re: Risks of deterministic builds

2021-04-09 Thread Jean Louis
* Jan Nieuwenhuizen [2021-04-08 16:43]: > Martin writes: > > > Maybe freedom in "free software" shouldn't require from the code to be > > open neither. Let's just blindly trust some saint developers who > > cannot even control their own binaries. Actually today we are closer > > and closer to

Re: Risks of deterministic builds (was: Re: Truth matters when writing software and selecting leaders)

2021-04-09 Thread Jean Louis
* Martin [2021-04-06 12:22]: > > From practical viewpoint, among milions and millions of users, when it > > comes to validating compiler, they would have to validate the > > reproducible build with comparison to something. Benefits of > > reproducible builds thus depend of number of people

Re: Risks of deterministic builds

2021-04-09 Thread Jan Nieuwenhuizen
Martin writes: > Maybe freedom in "free software" shouldn't require from the code to be > open neither. Let's just blindly trust some saint developers who > cannot even control their own binaries. Actually today we are closer > and closer to that sad scenario like never before in the history, >

Re: Risks of deterministic builds (was: Re: Truth matters when writing software and selecting leaders)

2021-04-08 Thread Martin
On 4/6/21 7:40 AM, Jean Louis wrote: * Jacob Bachmeyer [2021-04-06 05:39]: Exploits are easier to develop when hardcoded offsets, virtual addresses, etc. can be used. In a "binary monoculture" environment, that is possible. This contributes to and worsens security problems in proprietary

Re: Risks of deterministic builds (was: Re: Truth matters when writing software and selecting leaders)

2021-04-07 Thread Jean Louis
* Jacob Bachmeyer [2021-04-06 05:39]: > Exploits are easier to develop when hardcoded offsets, virtual addresses, > etc. can be used. In a "binary monoculture" environment, that is possible. > This contributes to and worsens security problems in proprietary software, > which is almost always