So much time has been wasted by the open source community on pointless projects like this.

>Reproducible builds allow people to "have more confidence that the binary you are using, which is actually executing on the computer, corresponds to the source code".

The developer signing the build provides sufficient guarantees. Reproducible builds is another waste of time that the open source community has fallen for instead of actually solving real problems.

>Bootstrappable builds can prevent the kinds of problems that Ken Thompson described in his famous Turing Award lecture: Reflections on Trusting Trust.

So much time is being spent on a theoretical problem. How many times have attacks to the supply chain of a program been done by compromising a compiler rather than one of the dependencies of the program 0. Why is time being spent on attacks which have never shown up in the wild?

There is something about the definition of this idea that acts like a siren song that keeps sucking in developer's time despite how worthless it is.

> The developer signing the build provides sufficient guarantees.

There are tons of documented cases of people resorting to physical attacks to obtain valuable cryptographic signing keys stored in full in one place.

https://github.com/jlopp/physical-bitcoin-attacks

I can only guess the people painting targets on their backs that big are woefully unaware of it, or living in deep survivors bias.

Trusting control of the entire internet to the laptop memory holding the PGP signing key that signs debian packages of GCC was always an insane thing to do, and still is.

Imagine what happens when one of those maintainers decides they like bribes or do not like being hit with rubber hoses.

Quorum signing of full source bootstrapped deterministic builds completed on independently owned and geo-distributed hardware produced by different vendors is currently the only viable solution to greatly reduce the incentive to coerce maintainers.

Just for perspective, the people working on his are pursuing their hobbies and sharpening their programming skills. In contrast, you are using your time to whine about it on the internet.

This project is not pointless at all. It's not about "reproducible builds", but about building a full present system from "first principles". It would be a way out of a significant dependability problem barely anyone today is aware of.

I have developing software in C(++) since 1990, but I did learn some new things about the language when developing a C compiler for a live-bootstrap variant not using the GNU Mes compiler.

It is their time to “waste” though.

This is probably not a convincing argument, but I'll share it anyway.

Think of bootstrapable builds as a hedge against tyranny.

Is it likely that a future regime could come into being that would be backdooring FLOSS builds and undermining confidence in the entire ecosystem? Not at all likely, as this requires a purge of all the install/boot media already out there.

Though after the passage of decades, the chain of custody starts to weaken. Maybe I'll still believe in the magic of the CD in my retro closet with the three humans holding hands in a circle, but in an environment where children are told to report the thoughtcrimes of their elders, how can my nephews and nieces in turn trust me and my testimony that my copy is the "good stuff" from "the before times".

This is all very far fetched sci-fi material, but think in terms of tail risk, low probability multiplied by a high cost if comes to pass.

Perhaps a regime horrible enough to break FLOSS would be horrible enough to purge all legacy hardware and software sitting in closets, but I do think it is easier to mess up the internet and the social fabric than it is to do house to house cleanouts.

Maybe messing around with untainted FLOSS will be too dangerous in such an environment anyway, but if we can assume a state of liberty eventually returns, having a great bootstrap ready to go can help rebuild society, cyberspace, and trust on an accelerated basis.

All of this hinges on people actually auditing source code, though once you've read enough bootstrapped source to have confidence in the generation of checksums you can at least start to fall back on a social consensus as to the safety of additional source archives that have known checksums and from there also digital signatures once you've built the tools for validating those.

When it comes to "trust, but verify" of other people's source code, there is a new tool in the toolbox: large language models have demonstrated some considerable audit value. Of course almost nobody is training their own models and it's only a slightly larger circle that does inference on their own hardware or attested remote hardware, but all of this is at least something that can increase confidence when working from other folks source code.

-------

As far fetched as full on cyber tyranny sounds, its worth remembering that in North Korea this is actually reality. Folks do not have access to the internet and are handed the state built binary of Red Star OS.

The ballooning of flash drives containing western media is still a thing despite attempts to stop it.

It is unlikely that anyone will ever send in a software bootstrap, that it will get in the hands of someone who can understand it, have the time to read it and build it.

But the scenario does make us think about the value of bootstrapable FLOSS as a tyranny hedge.

Without real internet access, what good does having some freedom on a computer even do? I suppose one can keep a diary encrypted, though possessing an encrypted file is probably more of a liability than any value it provides. Someone may also find encryption helpful for friend to friend networks by sneakernet, though the downsides are considerable.

Someway, somehow the regime may fall. After decades of not trusting the outside world and being governed by a hostile state, perhaps there will be at least one deeply computer literate person to emerge from that place who will appreciate being able to bootstrap their own personal cyber citadel.