Comment on Is Foss really safe?
Nibodhika@lemmy.world 1 year agoYes, however there are ways of verifying that. Compiled programs are not black boxes, they’re just complicated enough that we can consider them beyond human comprehension (at least complicated programs), but they’re very much readable. Which means programs can check differences between what should be there and what is. Not to mention that you can also compile the code they said they put there and check for differences with what they’re distributing.
Is anyone doing that? Don’t know, but because it’s possible to be verified it’s unlikely that people would try to do something nasty.
zalack@kbin.social 1 year ago
It's worth pointing out that reproducible builds aren't always guaranteed if software developers aren't specifically programming with them in mind.
imagine a program that inserts randomness during compile time for seeds. Reach build would generate a different seed even from the same source code, and would fail being diffed against the actual release.
Or maybe the developer inserts information about the build environment for debugging such as the build time and exact OS version. This would cause verification builds to differ.
Rust (the programing language) has had a long history of working towards reproducible builds for software written in the language, for instance.