{"action":"created","issue":{"url":"https://api.github.com/repos/Eloston/ungoogled-chromium/issues/846","repository_url":"https://api.github.com/repos/Eloston/ungoogled-chromium","labels_url":"https://api.github.com/repos/Eloston/ungoogled-chromium/issues/846/labels{/name}","comments_url":"https://api.github.com/repos/Eloston/ungoogled-chromium/issues/846/comments","events_url":"https://api.github.com/repos/Eloston/ungoogled-chromium/issues/846/events","html_url":"https://github.com/Eloston/ungoogled-chromium/issues/846","id":515880521,"node_id":"MDU6SXNzdWU1MTU4ODA1MjE=","number":846,"title":"no condition to compile and hard to trust the bin","user":{"login":"playgithub","id":3665590,"node_id":"MDQ6VXNlcjM2NjU1OTA=","avatar_url":"https://avatars0.githubusercontent.com/u/3665590?v=4","gravatar_id":"","url":"https://api.github.com/users/playgithub","html_url":"https://github.com/playgithub","followers_url":"https://api.github.com/users/playgithub/followers","following_url":"https://api.github.com/users/playgithub/following{/other_user}","gists_url":"https://api.github.com/users/playgithub/gists{/gist_id}","starred_url":"https://api.github.com/users/playgithub/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/playgithub/subscriptions","organizations_url":"https://api.github.com/users/playgithub/orgs","repos_url":"https://api.github.com/users/playgithub/repos","events_url":"https://api.github.com/users/playgithub/events{/privacy}","received_events_url":"https://api.github.com/users/playgithub/received_events","type":"User","site_admin":false},"labels":[{"id":223840431,"node_id":"MDU6TGFiZWwyMjM4NDA0MzE=","url":"https://api.github.com/repos/Eloston/ungoogled-chromium/labels/question","name":"question","color":"cc317c","default":true}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":9,"created_at":"2019-11-01T02:54:20Z","updated_at":"2019-11-02T19:25:47Z","closed_at":"2019-11-01T03:52:48Z","author_association":"NONE","body":"Google is blocked by the government.\r\nUsing VPN/SS/VPS to download so many stuff is very slow and at risk of blocking,\r\nand a lot of money for a fast proxy.\r\nStill it's somehow hard to trust the third party pre-built binaries. BTW, using AUR.\r\nAny help?\r\nThanks"},"comment":{"url":"https://api.github.com/repos/Eloston/ungoogled-chromium/issues/comments/549073379","html_url":"https://github.com/Eloston/ungoogled-chromium/issues/846#issuecomment-549073379","issue_url":"https://api.github.com/repos/Eloston/ungoogled-chromium/issues/846","id":549073379,"node_id":"MDEyOklzc3VlQ29tbWVudDU0OTA3MzM3OQ==","user":{"login":"Eloston","id":1305560,"node_id":"MDQ6VXNlcjEzMDU1NjA=","avatar_url":"https://avatars2.githubusercontent.com/u/1305560?v=4","gravatar_id":"","url":"https://api.github.com/users/Eloston","html_url":"https://github.com/Eloston","followers_url":"https://api.github.com/users/Eloston/followers","following_url":"https://api.github.com/users/Eloston/following{/other_user}","gists_url":"https://api.github.com/users/Eloston/gists{/gist_id}","starred_url":"https://api.github.com/users/Eloston/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Eloston/subscriptions","organizations_url":"https://api.github.com/users/Eloston/orgs","repos_url":"https://api.github.com/users/Eloston/repos","events_url":"https://api.github.com/users/Eloston/events{/privacy}","received_events_url":"https://api.github.com/users/Eloston/received_events","type":"User","site_admin":false},"created_at":"2019-11-02T19:25:47Z","updated_at":"2019-11-02T19:25:47Z","author_association":"OWNER","body":"@jstkdng @playgithub Let me try to be more clear about my perspective.\r\n\r\nI am *not* saying that reproducibility will give users absolute confidence in the pre-built binaries. Reproducibility is a property of the build process that can **increase** user's trust in pre-built binaries. This page describes how reproducibility can increase trust: https://reproducible-builds.org/. I will highlight some concepts of this page below.\r\n\r\nTo make reproducibility useful, you need a **distributed system of users** who can verify the binaries. More specifically, these users should have three aspects:\r\n\r\n1. They should be independent\r\n2. Most should act in good faith\r\n3. There should be a lot of them. The more people that are verifying the binaries, the faster that malicious binaries can be caught.\r\n\r\nNote that these three properties are common to many distributed systems, such as blockchains.\r\n\r\nWithout those three aspects, the distributed system does not work effectively. When the system does not work effectively, then reproducibility is not useful.\r\n\r\nWith this distributed system in place, it changes who we need to trust. There is no longer a single entity we have to trust (the packager), because we can also trust everyone that has verified the binaries.\r\n\r\nDoes this system actually work? Will it work for ungoogled-chromium? I don't know. But, it's theoretically better than the current situation, where we tell users that binaries *could* be compromised and they should trust an anonymous packager."}}
{"actor":{"display_login":"Eloston"}}