refalo @ refalo @programming.dev

Posts

4

Comments

1,426

Joined

1 yr. ago

The problem is not near enough projects support reproducible builds, and many that do aren't being regularly verified, at least publicly.

Yea because I tested it myself. Nobody else seems to care, and if they did, I would think there would be a public way to see regular test results regardless.

I know this exists for some projects, but somehow nothing privacy-sensitive

I have seen people with an axe to grind use frivolous lawsuits to reveal domain identities, you don't actually have to do anything wrong for that to happen.

I wasn't trying to do that, just making a general statement

What I do is use the "Arch Linux Archive" repo and set it to a specific date, which has a snapshot of all the packages from that time. That way I don't have to update all the time but can still install packages whenever I want. When I feel like updating then I just increase the date in the mirror URL. In pacman.conf you would set it like so: Server=https://archive.archlinux.org/repos/2024/08/30/$repo/os/$arch

153 binaries? where?

That is true, but also nobody is doing it. Just like nobody is verifying Signal's "reproducible builds".

this could be said about many popular open source projects

I don't understand how if this requires a VPN which I can't use?

Batteries do not explode, they burn.

besides lying, which might be illegal in your area, and/or grounds for having the domain seized if anyone complains.

google wallet is not required to be tied to any bank accounts, and US does not even support NFC within banking apps.

google wallet in general will not work.

also bank apps utilizing NFC is not a thing in the US

NFC payments also don't work. Non-starter for me

Anything that uses NFC payments.

subpoenas can still reveal the owner

subpoenas can still reveal the owner

subpoenas can still reveal the owner

because search engines exist

Unfortunately I cannot use a VPN because several apps I use (including android auto) do not work with it.