Re: [rtcweb] Cisco to open source its H.264 implementation and absorb MPEG-LA licensing fees

[Ron <[e-mail]>]

On Fri, Dec 13, 2013 at 03:33:00AM +0000, Mo Zanaty (mzanaty) wrote:
> Yes, Cisco and Mozilla plan on solving fully reproducible binaries for all
> targets officially supported in the openh264 project. Nothing less would
> be acceptable to the community, especially given the recent security
> incidents.

If nothing else but this comes out of this initiative, then I would have
to say it still would be a great success :)  I'm very glad to hear this.

It's not a case of "I don't trust Cisco" so much "I shouldn't have to".

If this raises the bar for others distributing pre-compiled binaries,
that would be an awesome outcome all on its own.


> We welcome contributions from anyone who has struggled with this in the
> past, and is aware of specific problems or solutions beyond the obvious
> ones below.
> 
> 1. Identical source trees (git hash)
> 2. Identical project configuration (make targets that include all
> configuration options)
> 3. Identical tool chains on similar build machines (same arch at least,
> probably x86-64)
> 4. Deterministic tool chains (avoid tool options that lack determinism)
> 5. Deterministically identical tool chain output must be hashed separately
> from uniquely generated data (build info, etc.)

The tor people would definitely be worth talking to here for first hand
information on what's solved and what still needs serious work.  They
have people working on this full time at present.

The link I posted in the other mail has some details, but I'm sure they'll
have plenty more to say if asked :)

> Some feel that tool chains can also be subverted and therefore should also
> be built from source, using some root golden tool chain. We are not that
> paranoid yet. Should we be?

Ken Thompson thought we should in 1995!

There is work being done on that too though, which not so much is about
providing a "golden tool chain" as a method of confirming that the one
you have is not corrupted.

But that's probably more of a job for the OS Vendors to do (and for the
real paranoids to confirm that they've done).  There's some information
on that here:

http://www.dwheeler.com/trusting-trust/
https://www.schneier.com/blog/archives/2006/01/countering_trus.html


Getting the openh264 builds reproducible to begin with is probably the
best initial investment, since that will identify the compiler(s) used,
and people can use the above technique to confirm that compiler is clean.

At least for the compilers that you can build yourself from source.

  Ron