It’s referring to binary blobs. A windows exe might be a binary blob.
These are distributed compiled. Even if the project is open sources, the binary blob might have been generated by a compromised compiler.
This is one of the reasons the XZ Utils compromisation went unnoticed for so long. One of the compressed files used for testing contained malicious code that would be included in the build artefacts (IE, the final compiled binary) under very narrow and specific circumstances.
So “deblobbed” means absolutely everything in the OS was built & compiled on their computer from original source code
Thanks. But I don’t understand why any of that ensures that the compiler isn’t compromised? Do you mean they have presumably vetted the compiler themselves first? This is something that would be incredibly time consuming to do, assuming we are talking about gcc or something equivalent, which, I mean if you’re compiling an OS…
The concepts they’re referring to have more to do with Ken Thompson’s Trusting Trust essay. Laurie Wired recently came out with an episode about it. It’s a rather intractable problem in computing, and unfortunately, even with the best practices to overcome it, you can never be 100% sure that your system is completely free of compromise.
That’s true.
But the idea is that there are no precompiled binaries that are implicitly trusted.
So you CAN vet all of the code and artefacts, and if something doesn’t seem right you can trace it back to the code and understand exactly why, instead of seeing a black-box binary and coming to the conclusion “it’s doing something it shouldn’t, but I don’t know what or why”.
The idea is that you are in control of the entire build process.
But yes, it would be extremely time consuming to vet GCC, build it from source and (I guess) compare checksum/hashes against published binaries. Then vet all of the source code of everything you need to compile for Gentoo, then compile that and compare checksum/hashes etc.
Which is why it’s in a 4chan meme.
But I imagine governments agency will have some deblobbed Linux installs with the technical capacity to vet all the code and artefacts
It’s referring to binary blobs. A windows exe might be a binary blob.
These are distributed compiled. Even if the project is open sources, the binary blob might have been generated by a compromised compiler.
This is one of the reasons the XZ Utils compromisation went unnoticed for so long. One of the compressed files used for testing contained malicious code that would be included in the build artefacts (IE, the final compiled binary) under very narrow and specific circumstances.
So “deblobbed” means absolutely everything in the OS was built & compiled on their computer from original source code
Thanks. But I don’t understand why any of that ensures that the compiler isn’t compromised? Do you mean they have presumably vetted the compiler themselves first? This is something that would be incredibly time consuming to do, assuming we are talking about gcc or something equivalent, which, I mean if you’re compiling an OS…
The concepts they’re referring to have more to do with Ken Thompson’s Trusting Trust essay. Laurie Wired recently came out with an episode about it. It’s a rather intractable problem in computing, and unfortunately, even with the best practices to overcome it, you can never be 100% sure that your system is completely free of compromise.
Funny, I just watched it :D great recommendation
That’s true.
But the idea is that there are no precompiled binaries that are implicitly trusted.
So you CAN vet all of the code and artefacts, and if something doesn’t seem right you can trace it back to the code and understand exactly why, instead of seeing a black-box binary and coming to the conclusion “it’s doing something it shouldn’t, but I don’t know what or why”.
The idea is that you are in control of the entire build process.
But yes, it would be extremely time consuming to vet GCC, build it from source and (I guess) compare checksum/hashes against published binaries. Then vet all of the source code of everything you need to compile for Gentoo, then compile that and compare checksum/hashes etc.
Which is why it’s in a 4chan meme.
But I imagine governments agency will have some deblobbed Linux installs with the technical capacity to vet all the code and artefacts
Ah yes… Government… Yeah they seem extremely,… very competent… For sure, for sure . But yeah , thanks see ya
Thanks! I wonder if I will ever reach that level of privacy paranoia. At the rate that I’m going, maybe 5 years.