reproducible_builds_status_update.webm

Next talk

Chris and Holger are going to talk to us again

about reproducible builds and tell us
where they're up to.

Thanks very much

The outline of this talk is from last year
we realised there were a lot of questions.

The rough plan is to quickly go over
what reproducible builds are

I guess everyone is up to speed

but getting everyone on the same page
would be a good idea.

Then Holger's going to jump in
and give the status update

and then we're going to talk about
future work, questions etc

What is the actual problem we're
solving here?

You can always inspect the source code of
free software for malicious flaws

or just flaws as well.

Unfortunately distributions provide
precompiled binaries to end users.

So can you actually trust this
compilation process has not

introduced flaws of its own?

The problem is it seems very effective if
you want to go after end users

you can go after developers.
Because if you go infect a developers

machine you will then infect all the
users of the software they generate.

Financial incentives. There always were
but they are even more so these days

with mobile phone etc.

You can also have very subtle flaws.
This one in particular there was a

root exploit in OpenSSH just by changing
a compare equal.

That sort of assembler jump thing and it
gives you root

but with only a single bit difference in
the binary.

Which is not to shabby.

Then you have all sorts of cute demos
where you load up the source code in VIM

and it just looks like 'Hello world' but
when you compile it with GCC

your kernel rootkit just goes 'oh I'm
going to give you a different file'

and self replicates of them like that.

Difficult to trust the process.

And there's some recent history as well
around Xcodeghost and iOS

and adverts and things like that.

You can Google those things.
Really scary stuff.

The last example is actually coming from
a CIA design paper from 2012.

Which was then found in the wild in 2014.
So these exploits are actually happening.

People are targeting developers to get
users.

Xcodeghost had 20 milllion user
installations.

It was probably not the CIA or NSA but
we don't know who it was.

There are many people who do these
exploits in the wild.

Yeah it's not just 'Here's this cute
thing we can talk about'.

It's actually happening.

The motivation is to ensure no flaws are
introduced during the build process.

We do this by ensuring the build always
produces identical results.

Then multiple parties do the same thing.

I build it, you build it, your friends
build it etc

An an attacker would need to infect
everyone simultaneously

otherwise they'd be detected.
For example if my machine was compromised

I would suddenly come up with a
different result.

I would come up with different binaries.

And you'd be 'what's going on here' and
eventually we would discover

that my machine was rootkitted etc.

You probably know it but identically
means bit by bit identical.

As that is really the same.

Yeah, bit, SHA, MD5 whatever you want.

There are a bunch of challenges here.
The biggest one is timestamps.

A lot of software just loves to include timestamps everywhere