Re: [rtcweb] Cisco to open source its H.264 implementation and absorb MPEG-LA licensing fees

[Cullen Jennings <[e-mail]>]

On Dec 12, 2013, at 4:44 PM, Ron <[e-mail]> wrote:

> On Thu, Dec 12, 2013 at 11:25:38PM +0100, Daniel-Constantin Mierla wrote:
>> 
>> On 12/12/13 22:32, Ron wrote:
>> [...]
>>> 
>>> 
>>> It does however raise a brand new problem (one which is actually quite
>>> technically interesting!), and I am interested to know if that was just
>>> a misunderstanding on your part in explaining it, or if you actually do
>>> plan to really solve this. [1]
>>> 
>>> You talk about Mozilla fingerprinting the *source* that they verified,
>>> and then being able to confirm that fingerprint in the binary blob they
>>> download from the Cisco build farm.
>>> 
>>> I had previously assumed people were only planning to take a hash of
>>> the binaries already up there, merely to ensure the blob that a user
>>> actually downloaded wasn't some totally foreign trojan, but was what
>>> was expected to come from the Cisco site.
>>> 
>>> 
>>> There is considerable work presently being done on fully reproducible
>>> binaries, since obviously this is of interest on many fronts, but it's
>>> currently far from being a universally (or easily) Solved Problem.
>> 
>> At least there were several people concerned about trusting the blob
>> version being built from the open sourced code. I, as one of them,
>> got the answer that I can take the code and build it on my system
>> and then compare the binaries
> 
> That's the bit that actually makes this Hard and Interesting.
> 
> If you take the code, and build it on your own system, then it's far
> more likely than not that the binaries *will* be different.  Even if
> you really did compile exactly the same source code.
> 
> Which is why I'm curious if this is a misunderstanding, and Cullen
> described how he hoped or thought it would work (but how it probably
> almost certainly won't) -- or if they actually are planning to solve
> the problems which would make this (somewhat) possible to do.

The thing that is hard is making a compile match an existing binary when you don't really know how the original binary was compiled. The plan here is to exactly describe the process that Cisco uses to compile (which linux distro, which version, which compiler version etc, all the build scripts etc). Then any external group, such as Mozilla, can replicate theses instructions and get the same binary. I do realize that if you build the same code on even very similar systems, you may get a different binary. I realize it is not trivial to get this to all happen but we are confident it can be done.