> Not to mention, the code to do this would have to land in our public repos on GitHub, where we would quickly be tarred and feathered.
What is the status of reproducible builds for the Brave browser?
What is the status of reproducible builds for the Brave browser?
In other words, being able to verify that the source code that is included in the build of Brave that Brave distributes, is the same as the source code we can view publicly.
If you're not familiar what reproducible builds are, I suggest you examine the following article:
* https://brendaneich.com/2014/01/trust-but-verify/
Mozilla, however, is different, in that all builds are posted to ftp.mozilla.org, in a versioned manner, and kept there for a while, which, at least in theory, makes it easier to verify or analyse the builds.
What is the situation with Brave? Can I download a version released a few months ago? As it is, the browser is not only not really versioned (at least in the binary form), but there's not even a way to disable it from automatically updating itself. Self-modifying code, where the user has no control over the channel under which the modifications are pushed, is inherently insecure from the reproducibility's perspective.