How to make Linux more trustworthy
Reproducible builds is an excellent QA initiative, but let&#x27;s not overestimate their security benefits.<p>They&#x27;re maybe going to protect us from random ELF viruses on developers&#x27; machines, but not from a targeted attack.<p>Why bother pwning binaries when it&#x27;s much easier to pwn the source?<p>I mean, it&#x27;s so easy it&#x27;s already been done:<p><a href="https:&#x2F;&#x2F;lists.debian.org&#x2F;20030213165225.GB7379@azure.humbug.org.au" rel="nofollow">https:&#x2F;&#x2F;lists.debian.org&#x2F;20030213165225.GB7379@azure.humbug....</a>