Re: [rtcweb] Cisco to open source its H.264 implementation and absorb MPEG-LA licensing fees

[Daniel-Constantin Mierla <[e-mail]>]

On 12/12/13 22:32, Ron wrote:
[...]
>
>
> It does however raise a brand new problem (one which is actually quite
> technically interesting!), and I am interested to know if that was just
> a misunderstanding on your part in explaining it, or if you actually do
> plan to really solve this. [1]
>
> You talk about Mozilla fingerprinting the *source* that they verified,
> and then being able to confirm that fingerprint in the binary blob they
> download from the Cisco build farm.
>
> I had previously assumed people were only planning to take a hash of
> the binaries already up there, merely to ensure the blob that a user
> actually downloaded wasn't some totally foreign trojan, but was what
> was expected to come from the Cisco site.
>
>
> There is considerable work presently being done on fully reproducible
> binaries, since obviously this is of interest on many fronts, but it's
> currently far from being a universally (or easily) Solved Problem.
At least there were several people concerned about trusting the blob 
version being built from the open sourced code. I, as one of them, got 
the answer that I can take the code and build it on my system and then 
compare the binaries (the answer was not from Cisco, saying it just to 
be sure is not inducing anyone in error). Upon a follow up that whether 
we should expect mobile devices to be shipped with compile tools and 
devel libs soon, the reply came that cross compilation should (can) be used.

Its going aside the topic of this mailing list, but as you, I would be 
also very interested to see a solution for fingerprinting the sources 
and then matching the binary outcome from third party build systems.

Back on topic, my concern was for custom/new applications using the 
blobs. Maybe Mozilla (+ other major browsers or large companies) and 
Cisco can get to a mechanism between them that Mozilla builds the blobs 
and uploads them to Cisco. Firefox on your device will take it from 
Cisco site and compare the fingerprints. I don't think will solve all 
the security concerns, but can shift the trust relation to Mozilla, as 
between the application and its mother company (i.e., if one doesn't 
trust Mozilla, it shouldn't use bare Firefox binary in the first place).

Daniel

-- 
Daniel-Constantin Mierla - http://www.asipto.com
http://twitter.com/#!/miconda - http://www.linkedin.com/in/miconda