No, I’m not concerned about a lawsuit. It’s something that I want to do because I think that it is important. If I want to share tools with non-tech savvy people who are unable to build them from source, I want to be able to share these without anyone needing to “trust” me. The reproducible builds standards are a very nice idea, and I will learn how to implement them.

But I still wonder whether my approach is valid or not - is printing the hash of the output executable during Github’s build process, such that it is visible in the workflow logs, very strong evidence that the executable in the release with the same hash was built by github through the transparent build process? Or is there a way a regular user would be able to fake these logs?

But, if during Github’s build process the sha156sum of the output binary is printed, and the hash matches what is in the release, isn’t this enough to demonstrate that the binary in the release is the binary built during the workflow?

Ooh, I did not know this one was of the properties of Rust.

Thanks! I am convinced now, I will learn how to create reproducible builds.

My worry is that the build is run through npm, and I think that the dependencies rely on additional dependencies such as openssl libraries. I worry that it will be a lot of work to figure out what every npm dependency is, what libraries they depend on, and how to make sure that the correct versions can be installed and linked by someone trying to reproduce the build 10 years from now. So it looks like a difficult project, but I will read more about it and hopefully it is not as complicated as it looks!

Ooh, I think I found the paper!

Oof:

The actual bug I planted in the compiler would match code in the UNIX “login” command. The re- placement code would miscompile the login command so that it would accept either the intended encrypted password or a particular known password. Thus if this code were installed in binary and the binary were used to compile the login command, I could log into that system as any user

Ah. Cool. I was under the impression that docker images suffered from a similar issue - that one can’t verify that the image is built from the source. I’m happy to be mistaken about that.

How does a docker distribution solve this problem? Is it because the build instructions are automated by the Dockerfile?

My new phone runs GrapheneOS and I love it.

One recommendation that I would give people is that it does not need to be an all-or-nothing jump into the abyss. It can be a bit disheartening when you try to get rid of all the privacy-invasive things in your life and you get cut off from your family and friends.

After some failed attempts, the strategy that I have found more successful is that I have new phone that I installed GrapheneOS into, and I keep the older phone with whatsapp. The older phone is in Airplane mode connected to WiFi at my home. It is effectively a landline. I can still use it once or twice a day to check on my family through WhatsApp without having to broadcast my location all day to Meta. This way I don’t need to install any sandboxed Google Play services into my new phone. The old phone is the sandboxed Google Play. I also use the old phone for verifications, 2FA, and any other things that I don’t want to contaminate my new phone with.

Over time I am finding that my GrapheneOS is perfectly functional. The main difficulty is the chats services that are used by my family, friends, and work-related “group chats”. I have convinced some people to join my XMPP server, including my mom (wuhuu), but it is an uphill battle. That’s why the other phone is still essential for me.

I think you can even upload release files manually, independently of if you use actions or not, so it can never be guaranteed that it was built from the sources.

True, but that’s why my current idea is the following:

As part of the wortkflow, GitHub will build the executable, compute a few different hashes (sha256sum, md5, etc…), and those hashes will be printed out in the GitHub logs. In that same workflow, GitHub will upload the files directly to the release.

So, if someone downloads the executable, they can compute the sha256sum and check that it matches the sha256 that was computed by github during the action.

Is this enough to prove that executable they are downloading the same executable that GitHub built during that workflow? Since a workflow is associated a specific push, it is possible to check the source code that was used for that workflow.

In this case, I think that the only one with the authority to fake the logs or mess with the source during the build process would be GitHub, and it would be really hard for them to do it because they would need to prepare in advance specifically for me. Once the workflow goes through, I can save the hashes too and after that both GitHub and I would need to conspire to trick the users.

So, I am trying to understand whether my idea is flawed and there is a way to fake the hashes in the logs, or if I am over-complicating things and there is already a mechanism in place to guarantee a build.

If I understand this correctly, signify would allow someone to verify that the executable was built by me. But then they would still have to trust me, because I can also sign the malicious executable.

Finally. Someone noticed 🥹

The creator of the tool is the admin of lemmings.world, and the tool is hosted at schedule.lemmings.world. So, if you have a user at lemmings.world, you can use this tool without having to trust a third-party.

If you don’t have a user there, you can create a user in that instance for the purpose of creating scheduled posts. Removing the need to trust two parties rather than one.

And, of course, since the source code is open anyone else can attach this to their own instance! Pretty cool.

Ah, do you mean “hate speech”?

Thanks! It is some consolation. 🫂

PhD thesis! 😅

Gluing my ass to the chair won’t be sufficient. I think I have some form of computer distraction addiction or undiagnosed ADHD, because when I am sitting at the computer I find it really hard to do what I need to do. I am able to find a universe of distractions by slightly moving my fingers, and I have an inordinate ability to psychologically (not rationally!!!) justify it as being somewhat useful. The only thing that saves me is that I can be very efficient when I do focus, but this has become more difficult as the complexity of the work increases, and so many different figures, tables, and concepts have to coalesce together to tell a story that I genuinely believe…

I would probably have a better chance trying to write with pencil and paper in an isolated island than with LaTeX in my computer…

Thanks! I’m at 90% now :) Things that affect the nerves are scary, but the doctor helped calm my fears as symptoms were consistent with a not-too-serious sinus infection.

Aah, ok! That at least explains what they could have been thinking.

But, of course, this is a terrible idea!!

Both sides? “Oh yeah, the front looks a lot like the ID I lost, but can you please send me the back side too so that I can confirm?”

TIL. That’s an interesting craft!

Some virus managed to wreck inflammatory havoc around some of my nerves and the right side of my head has been numb since Thursday, my ear in pain, and a zoo of sporadic symptoms come and go 😅 So I have been in the computer a lot. I’ve been working on setting up a lemmy instance and I also played in the canvas.

As for the rest of the week… I have been procrastinating on thesis writing, and I need to be done before September, so I am trying to find a source of will-power to force myself to write. But this infection is not helping me 😬