Re: [rtcweb] Cisco to open source its H.264 implementation and absorb MPEG-LA licensing fees

[Ron <[e-mail]>]

On Thu, Dec 12, 2013 at 11:25:38PM +0100, Daniel-Constantin Mierla wrote:
> 
> On 12/12/13 22:32, Ron wrote:
> [...]
> >
> >
> >It does however raise a brand new problem (one which is actually quite
> >technically interesting!), and I am interested to know if that was just
> >a misunderstanding on your part in explaining it, or if you actually do
> >plan to really solve this. [1]
> >
> >You talk about Mozilla fingerprinting the *source* that they verified,
> >and then being able to confirm that fingerprint in the binary blob they
> >download from the Cisco build farm.
> >
> >I had previously assumed people were only planning to take a hash of
> >the binaries already up there, merely to ensure the blob that a user
> >actually downloaded wasn't some totally foreign trojan, but was what
> >was expected to come from the Cisco site.
> >
> >
> >There is considerable work presently being done on fully reproducible
> >binaries, since obviously this is of interest on many fronts, but it's
> >currently far from being a universally (or easily) Solved Problem.
>
> At least there were several people concerned about trusting the blob
> version being built from the open sourced code. I, as one of them,
> got the answer that I can take the code and build it on my system
> and then compare the binaries

That's the bit that actually makes this Hard and Interesting.

If you take the code, and build it on your own system, then it's far
more likely than not that the binaries *will* be different.  Even if
you really did compile exactly the same source code.

Which is why I'm curious if this is a misunderstanding, and Cullen
described how he hoped or thought it would work (but how it probably
almost certainly won't) -- or if they actually are planning to solve
the problems which would make this (somewhat) possible to do.


And I had actually forgotten how unintuitive this problem might be
to people who use regularly software they don't have the source to
until you mentioned being told that :)

  Ron