On: Private by Design: How We Built Firefox Sync

[zimbatm]

The question is how hard it is to detect tampering. My linux distribution builds firefox from source and signs the build. The builds are also checked to be reproducible.

Raising the bar is a good thing.

[tomrittervg → zimbatm]

I wasn't aware that any distribution (besides Tor Browser) was building Firefox (or anything really) reproducibly.

There's debian's https://reproducible-builds.org/ effort, but I thought that wasn't making much progress lately, nor was it deployed.

Could you provide more info on what distro you're using, or how they're doing this?

[srazzaque → tomrittervg]

S/he may be referring to Gentoo Linux.