Hacker News Reader

Is it technically pointless if you view it as a check on your own build, rather than a check on the work of others?

You are obviously familiar with Bazel/Blaze etc. Wouldn't reproducibility be necessary for those systems to work well most of the time? I can think of exceptions (like PGO), but it seems useful to produce at least some binaries this way. Also covered in this: https://security.googleblog.com/2021/06/introducing-slsa-end...

View on HN

> Is it technically pointless if you view it as a check on your own build, rather than a check on the work of others?

That depends, I think it's difficult and mostly still pointless. I wrote about this a bit in the blog post I linked to. It's a big trade off, for questionable benefit.

> Wouldn't reproducibility be necessary for those systems to work well most of the time?

Yes, there are definitely some good non-security reasons to want deterministic builds. My gripe is only with the security arguments, like claims it can reduce threats of violence against developers (!?!).

Reply on news.ycombinator.com