-
@taviso @halvarflake @fugueish @alexstamos @sleevi_ @durumcrustulum @LeaKissner I think I now know the difference in our mental threat model. Do you assume vendors to be fully capable of securing their build infrastructure if they also write trustworthy code? I.e. either the lie about their code (and are capable of writing good bugdoors), or they are honest.Permalink On twitter.com
♻️ 1 Retweets Mood +5 🙂
-
@taviso @halvarflake @fugueish @alexstamos @sleevi_ @durumcrustulum @LeaKissner I see it as a non-binary spectrum. Most vendors make mistakes. One set of engineers writes code, a slightly different set might build it and send you binaries. Then another vendor packages it in a bigger piece, again building/linking on their infra. Lots of mistakes happen.On twitter.com
-
@taviso @halvarflake @fugueish @alexstamos @sleevi_ @durumcrustulum @LeaKissner That is, I don't believe all vendors to be capable of writing completely deniable bugdoors. The low code quality we see in practice means it's a lot easier to write a real, intentional backdoor in a binary-only release (and without repro, you can't match to published source) orPermalink On twitter.com
-
@taviso @halvarflake @fugueish @alexstamos @sleevi_ @durumcrustulum @LeaKissner be compelled to / overridden by another team to add something "bad" at the build stage than to do that undetected (for a time) and deniable (after detection) in source code with reproducible builds. In that spectrum of non-expert-underhanded-coders, I see value in repro builds.Permalink On twitter.com