> Q. If a user has chosen to trust a platform where all binaries must be codesigned by the vendor, but doesn’t trust the vendor, then reproducible builds allow them to verify the vendor isn’t malicious.
> I think this is a fantasy threat model. If the user does discover the vendor was malicious, what are they supposed to do?
> The malicious vendor can simply refuse to provide them with signed security updates instead, so this threat model doesn’t work.
For me, this is one of the primary benefits of reproducible builds and the author's dismissal of it as fantasy is unconvincing.
Vendors trade on trust. If a reputable application uses reproducible builds and discovers that a platform vendor is modifying their application on their platform, that information is damaging to that vendor's reputation. That's extremely useful leverage against potentially malicious vendors.
> I think this is a fantasy threat model. If the user does discover the vendor was malicious, what are they supposed to do?
> The malicious vendor can simply refuse to provide them with signed security updates instead, so this threat model doesn’t work.
For me, this is one of the primary benefits of reproducible builds and the author's dismissal of it as fantasy is unconvincing.
Vendors trade on trust. If a reputable application uses reproducible builds and discovers that a platform vendor is modifying their application on their platform, that information is damaging to that vendor's reputation. That's extremely useful leverage against potentially malicious vendors.