While reproducible builds are a good thing, for a bunch of reasons the whole stack is built on top of someone else’s microcode running on someone’s CPU, running someone’s BIOS, etc.
During an Linux Conf in Australia I attended a talk discussing the chain of trust and the point was made that when you buy something from a manufacturer, it is assumed that it comes to you unaltered, but the question is, how would you know?
In other words, you need to trust something somewhere and build on that.
If you’d like to see a working example of a backdoored compiler, because to compile something, you need to also trust your compiler, here’s a good discussion and show and tell:
While reproducible builds are a good thing, for a bunch of reasons the whole stack is built on top of someone else’s microcode running on someone’s CPU, running someone’s BIOS, etc.
During an Linux Conf in Australia I attended a talk discussing the chain of trust and the point was made that when you buy something from a manufacturer, it is assumed that it comes to you unaltered, but the question is, how would you know?
In other words, you need to trust something somewhere and build on that.
If you’d like to see a working example of a backdoored compiler, because to compile something, you need to also trust your compiler, here’s a good discussion and show and tell:
https://youtu.be/Fu3laL5VYdM