The episode effectively frames reproducible builds as the shift from blind trust to mathematical certainty in software integrity. It offers a grounded, essential analysis of the technical rigor needed to defend against increasingly sophisticated supply chain threats.
Deep Dive
Prerequisite Knowledge
- No data available.
Where to go next
- No data available.
Deep Dive
Late Night Linux – Episode 387Added:
Thanks for choosing to listen to this late night Linux family podcast. We're only able to do this because of the people who support us. None of our shows are paywalled, but our Patreon supporters can get most episodes early and never hear any ads. Learn more at latnightlininux.com/sport, or support us by telling a friend or colleague about everything we do.
Hello and welcome to episode 387 of Late Night Linux recorded on the 18th of May 2026. I'm Joe and with me are Fenim, >> Matt's co-processor >> and Andy.
>> Good evening.
>> Yeah, Will and Graeme are still away. So Andy, thank you very much for sticking around.
>> No worries. Nice to be here.
The Debian release team have decreed that for the upcoming Debian 14, all packages need to be reproducible.
>> Yay. This is good. Andy, you know about software. Tell us what reproducible means.
>> So, I know about this because I went through the pain of making one of my packages reproducible so that it could go on to Foid and be reproducible on Foid because they're really good about this. They It's not mandatory on Foid, but it's um very strongly encouraged. So basically reproducible just means if you build the same piece of software as me from the same source code then you should get the exact same binary out at the other side.
>> So I should get the same shard 256 sum for example.
>> Exactly. Exactly. And the reason why that's important is because then if someone's hosting binaries somewhere anyone can check whether those binaries are actually corresponding to the correct source code or they've got some back door inserted or something.
>> Right? So this is an excellent thing, but it's [ __ ] hard to do. It >> It's a real struggle, but I think it's largely a struggle because the tooling is not particularly set up for it and stuff. So once everyone is on board and this is a normal thing to do, it won't be hard at all.
>> But CI/CD systems give it a time stamp, for example, the binary, which means that every time you do it, it's going to be different.
>> Yeah. So you have to just stop all of that stuff. Basically, anything that puts in time stamps or uses some kind of randomness in any way needs to be fixed.
But you know once that's the norm I think that will be not too difficult.
>> And so do you think this goal is realistic then that everything in Debian 14 will be reproducible.
>> I must say I was surprised when I read that I think that's a pretty challenging goal but it I I read a little bit more it seems that they've already been working on this right. So it's not coming out of the blue. They've had quite a bit of stuff reproducible already and they decided that now is the time that they can achieve like everything being reproducible. I think that's really ambitious which is cool and probably a bit surprising for Debian who tend to be quite slow about things but yeah I think that's cool to be ambitious.
>> Is this a bit like SSL for websites?
Like for a long time it was just something that important stuff had banking and stuff and then let's encrypt comes along and it's like no we're not having this anymore. Everything's going to be SSL HTTPS that's going to be the standard. Can we get to that point do we think with reproducibility? I don't see why not. I mean, I think the need has to be there for it. And I think the fact that there is a very questionable supply chain sometimes where did that get built on the right server with the right version that we've all checked or did that somehow get built somewhere else by mistake, not even with malice involved and then add to that people maliciously trying to inject stuff into the whole repo. I think it's a great idea that they do this because if you can say, "Build it on your system, build it on mine, and we'll prove to each other that we both have the same thing." I mean, that is that's gold.
>> Just compatibility. Like, maybe you pulled in the wrong libraries or something.
>> Yeah. It's it's just kind of obviously right when you think about it. And I think we're just starting to become a bit more grown up about our supply chain, right? Like, so all of the attention for this has been on things like npm and stuff like that. And it is a bit more chaotic. you know, Debian and systems like it had they have a like a really strong personal reputation system that protects us from a lot of the dangers, but it doesn't protect us from the dangers of someone just coming and swapping a binary on a server. So, this gives us like an a further bit of defense in depth and it makes a really trustworthy system like Debian even more trustworthy. And maybe Yeah, maybe that will just be table stakes in the future.
>> Well, Debian being forward thinking for once.
>> Yeah, good on Debian. Debian's big selling point is trust. And this adds to trust. It can't be bad.
>> Yeah. Well done, Debbian. This is a fun one. EU calls VPN's a loophole that needs closing in age verification push.
So, I mean, this is not just the EU talking about this. We've seen the the UK government and other governments around the world saying, "Hang on, kids are getting around age verification by using VPNs. Well, we need to have age verification for VPNs, then. Good luck with that."
>> Yeah. Well, I think that it is actually relatively doable for, you know, your NordVPN and stuff like that, but anyone sufficiently technical will find a way around it.
>> 100%.
>> If kids want to see filth, they're going to see filth. It's really not hard.
>> Yeah, I think it there will be a significant number of people who won't work around this thing, right? I think it will improve the numbers of people who are not. If you think that's a good thing, but it pushes everyone else onto just worse VPNs, right, who are just really unscrupulous, which is scary.
>> Well, yeah. It especially pushes kids onto free VPNs, which do all sorts of nefarious [ __ ] And if anybody thinks I'm going to rock up to some office with my passport, and it's not the government only and get some sort of unidentifiable key that verifies I'm the right person, but doesn't identify me. they can just f right off. We all know the amount of trackers that pick us up as we go along across the internet. And if they think I'm going to like then provide my passport and the fingerprint with it and all the other biometric nonsense that's in a passport, it just absolutely absurd the idiocy of this. You are [ __ ] dreaming. If you think you're going to be going to an office, no, you're going to be holding it up to your webcam or your phone's camera.
>> No, no, no. What I said, what I meant was if it isn't that I would accept a unidentifiable token that says, "Right, this person checks out, but we're not identifying them to anybody on the outside and you know, cryptographically it's signed over here." I don't know.
It's all crypto nonsense. I have no idea how you do it. I'm sure there's a very smart people who can do this, but not me. But essentially, someone should have the list of people who are allowed and someone had have a list that says all these ID numbers are allowed and then if you're not on that ID list, yeah, whatever. But there's no way the amount of companies, they're just all so incompetent. I agree. I do not want to entrust my identity information to really anyone. Like almost every website on the internet has proof that they can't be trusted with my information.
And I, you know, I do my best to avoid having my credit card information on these sites. let alone my like really significant identity information because they're bound to lose it.
>> Oh well, there go my fingerprints. So best get the Dremel out and resurface my hands then. [ __ ] sake.
>> So yeah. So I'm going to do my best to just avoid ever verifying my age for anything and I'll just see how much of the internet is left, I guess.
>> Yeah.
>> Yeah. I suppose that's your best option really. I mean, I paid for uh five years of a VPN on the day that it happened in the UK. Like, I I tried to go to Reddit and it was just like wanting me to verify my idea. I was like, "What the [ __ ] I'm not doing this." And so, all right, I heard about this great deal on a VPN. It was like 15 quid for 5 years or something. I was like, "Well, I suppose I'll just pay the 15 quid then."
and I've been using it fine, but like what's going to happen if laws come in that say right, you've got to prove your ID and everything to use this VPN? Well, I suppose that's my 15 quid gone then cuz I'm [ __ ] not doing it. I've not verified my age anywhere yet and I I'm going to fight tooth and nail to not do that ever if possible. I don't know how possible it's going to be. I feel like eventually I'm just going to have to give into it, but it's going to be a sad day when I do. and all the kids will be using their video games to like verify or something like that, you know, like they'll find out the good ways around it. Well, I've heard two separate stories. Like one of the ways you can prove your age is just age estimation.
So you just turn your camera on and kids literally screw their faces up to look more wrinkled and it passes. And also they are just like drawing on mustaches with a Sharpie and that works as well.
>> What AI is fooled so easy. Oh, I said the word. Whoops. Sorry.
>> I mean, I'm just so overjoyed by that. I I'm now in favor of age verification.
>> It makes me think the kids are all right. You know, it's like when you see these videos of CEOs at the the college graduation ceremonies and they're talking about the thing we can't talk about and then all the the kids are just going boo. I say kids, young adults, boo.
That makes me feel like, yeah, they're all right. You know, >> fills me with joy.
EU browser choice rules send millions more users Firefox's way, but seemingly only on iOS because Google are a shower of bastards. So, I think we all remember the old Windows browser choice thing where it would pop up and give you a choice of browsers randomly and that was pretty good back then. Well, the EU have forced Google and Apple to do this on their phones and Apple have done it in good faith and as a result loads of people have started using Firefox because Apple made it so that it was the first time you open Safari you would get this choice whereas Google did the most malicious compliance that you can possibly do and just had it once on the first boot, you know, among the million other screens where people are just trying to [ __ ] next next it to actually start using it.
>> But hang on there. Apple have never done anything in good faith.
>> Okay. Well, less maliciously complied then.
>> Yeah, it was an accident is all I'm saying.
>> And also, hang on. So, Firefox managed to get users, but not by any of its own skill or features, but by government telling somebody to use something else.
Wow. Well done, Mozilla. You're brilliant. You're brilliant.
>> You couldn't take a positive story about Mozilla and be positive about it, could you? You had to find a way to [ __ ] on them. It's failing by default.
>> That's not what happened. That's not what happened. No one forced anyone to choose Firefox.
>> It's okay. Failing by ondefault then whatever.
>> No one forced anyone to use Firefox.
They were given the choice. People were given the choice and some people chose Firefox and they marginally more recognized. What's that Fire Cat thing?
Yeah. Yeah, I'll go with that one. Yeah.
Brilliant. Yeah. Because they have a good reputation.
>> Exactly.
>> Exactly. That's how clueless the users were. They thought that Firefox had a good reputation. This is a good news story. This is happy.
>> Is it though? I mean, >> yes. And we will not let you [ __ ] on it.
>> Someone has done some good regulation that makes the market slightly less completely twisted and more people using Firefox, which means there's some chance that Firefox will keep working for me.
>> Hey, I use it, too, but I don't think that's happening. But anyway, >> it is. It's the wonderful EU that me and Andy mourn the loss of.
>> Oh, yeah. Sorry. Sorry. Yes, you're right. You're right.
>> Although there's there's uh there's rumblings there's rumblings of rejoining now. The politicians are starting to have the guts to say it.
>> We're going to give back control.
>> What? You got three direct null pawns at the Eurovvision in a row and now you think you need to rejoin the EU to change the rules. Is it? Yeah. Okay, fair enough.
>> Look, Mom, one point. We got one point.
Poor Sam. I hope it doesn't change him.
one sympathy point from Ukraine because, you know, we've kind of helped them out a bit, but otherwise, no [ __ ] points from anyone.
>> So, has anyone else noticed that even though Firefox sometimes doesn't work on some websites, it remarkably still works perfectly on most websites?
>> Well, I was going to say that until as of last week, it's been really crap at Google Maps.
>> Oh, really? And I only reason I was looking at Google Maps is I needed a satellite image. But I think that might be because I added some more services to Pi Hole. And I think I tipped the let's give you shight service in a row from Google a bit too much.
>> Right. So you broke it and now it's broken.
>> Well, maybe. So this is on desktop, not mobile.
>> Yes. I have just tried now and it is [ __ ] atrocious. It's like stuttering and Yeah, it's terrible.
>> Is it? Ah, interesting. And and I found YouTube to be also equally [ __ ] Oh, >> so Google are starting to move against Firefox, are they?
>> No. Look, we've been over this a thousand times. It's not them moving against it's not some conspiracy. It's them not giving a flying [ __ ] and not testing on Firefox.
>> That's the same thing.
>> It's them just not caring, which is not the same.
>> It is the same. It's them semi- deliberately not caring. Well, it's them not caring if and if [ __ ] breaks, well, oh well.
>> Yeah, >> but it's not them deliberately breaking [ __ ] >> No, I'm not saying that they they had a meeting where they were like, "Okay, it's time for us to break Firefox."
>> But they all went in and went, "Let's not break Firefox." And did a lot of winking.
>> Yeah.
>> Yeah.
>> I can well imagine a meeting where they said, "You know, we won't dedicate so much resources to testing on Firefox."
>> Well, absolutely. Or any [ __ ] resources. Why would they? It's not in their interests. Why would they care?
>> We shouldn't have let them have a browser. I'm Marie and Ursula Vander Lion immediately.
>> Anyway, I've watched multiple different TV services over the last few years and they've all worked in Firefox which I always fall off my chair when that happens.
>> What when the DRM actually works?
>> I watch it through my Steam Deck. I have my Steam Deck plugged into my TV and I can watch, you know, Netflix and Apple TV and although actually now TV doesn't work on Linux, you have to boot into Windows. But if you boot into Windows, it works on Firefox. Well, I'm still pretty happy with Firefox and I've not noticed that maps thing until right now.
Oh, >> you're welcome.
>> And I'm hoping that all of that like stuttering and stuff didn't [ __ ] up my audio, but I suppose I'll find out when I edit it.
>> Cellot taping a whole lot of different words from different episodes together.
>> I actually did that recently.
I took something I said on one completely different show and put it into an episode of another show and nobody noticed because I [ __ ] something up, but I'd said it correctly on another show and I stitched it in seamlessly. So >> Oh, I'm going to go back and listen now.
Everything.
>> You will not find it. I guarantee you could listen for days and not find it.
>> You'd only deny it anyway.
>> It's cuz you're a consistent performer, Joe.
>> Yeah, there you go. All right. Well, speaking of browsers, I don't know why you put this in. do not care, but Oprah GX lands on Linux. So, proprietary gaming [ __ ] browser is now available for Linux. Great. Okay, so clearly I have the two wrongest people to be on the show with this particular piece of news. Will would have completely backed me up and Graeme may have nodded. Saging gun, I think I've heard of that. Yeah, but this is uh the gamer browser.
>> This is proprietary software that you love.
>> No, I do not. I do not. But I will I will say my son was not impressed when he couldn't have this on Linux and then went back to Windows because of well this and many other things but mainly it was the fact that it didn't have all the gamer stuff his pals had. Now the people in Opera GX land believe that the question on everybody's lips is apparently but where is opera GX on Linux and which I think they are chuffing on the uh crackpipe just a bit too much but I guess this is a good thing that you know if gamers are coming if Opera GX team is looking at this going oh my god there's loads of gamers coming we need to be in on that too because now it's a real thing then I think it all points in the right direction of goodness for Linux usage.
So I'm just saying I don't like it, but it's a good thing that they like it. No, I was just being silly. It is a good thing. It's definitely a good thing.
More popular proprietary software available for Linux as an option for people I think is always good. I would love it if all of the games in the world, all of the Adobe stuff, I don't think I'd be using much of it, if any of it. But if everything was available, then more people could use Linux, and that is definitely a good thing.
>> Yeah. Yeah. Yeah. Yeah. So, we we celebrate all the Steam stuff working on Linux. A lot of that's proprietary. Most of it.
>> Yeah. Yeah.
>> We'd like the Adobe suite to be there.
We'd like Microsoft Office to be there.
We'd like Opera GX to be there, but you know, we just can't get that excited.
Let's put it that way.
>> Yeah. Personally, we're not going to get excited about it. But it is good. So, and and you're right, Phenom, that it is a vote of confidence in gaming on Linux.
>> Yeah, I think so. It's a good sign, and that's a tribute to what Steam and Valve have done.
>> Yeah, definitely. Well, speaking of Steam and gaming, Valve have released the Steam Controller and Puck CAD files under a Creative Common license. This is under a non-commercial creative common license, though, so it's basically their way of encouraging people to 3D print and make their own accessories for personal use rather than for, you know, mass sale. If you want to do that, you're going to have to actually license them and, you know, pay Valve. But nevertheless, this is pretty cool.
>> Yeah, I think realistically that's fair, isn't it? I mean, you know, if you do want to do it, I'm sure they're not crazy money either for that commercial stuff, so not that I know. Yeah, it's very cool that it's like it means makes modding and accessories and stuff easy and that like that's very Steam, right?
You know, like all the kind of Steam Workshop stuff of like modding games and things like that. It makes sense. I was really disappointed to see it was a non-commercial license though because it it means that they haven't really bought into I mean, we know they haven't bought into the thing where if you're if you're open but you're still the best, then you still make money. You know, they still locking away all of their intellectual property and all their games and stuff.
and they're doing it in their controller as well. So, it's not a surprise. I wish they were more open. They've, you know, they've obviously bought into a lot of the stuff that's cool about getting to use other people's stuff that's open.
I'd love it if they caught the bug a little bit more and started being a bit more confident in themselves and truly open with their stuff.
>> Yeah, I know what you mean. But it's still like people will be able to share their mods with each other, just not sell them, you know?
>> Yeah. Which is totally cool. I think in general though that Steam have been good sort of citizens where they get to share even amongst other companies. Now I'm not obviously trying to sort of big them up to be bigger than they are, but I do think that if companies were still profitable and still sort of operated the way that they do, there'd be a lot less, you know, not everybody has to be the top and not everybody has to crush other people. you know, you can partner with other companies and ship work out to various open source developers around the place. I think that's a good thing.
>> Yeah, I totally agree. Like they and they've contributed upstream to a number of open source projects fully open source, right? So, I don't want to underell the cool stuff that they've done. I just think they're a company who are on the edge of really getting it.
Wouldn't it be amazing if they did? I think the problem is that they're also kind of trying to compete with the likes of Xbox and Sony and Nintendo which are sort of the oil versus water level of not open. So I I don't know. I it would be our place to be I think. Yeah. But they're profiting a lot from their openness already, right? Like so the reason why they are doing so well in the gaming world is because their stuff runs on this open PC platform, right? So they they they get that openness can be the way to win, >> but just not too open.
>> Yeah. Which to be fair, like no one has proved that you can be really open and then make tons of cash in the game world, right? And only really Red Hat have proved that you can do it in the uh operating system world.
>> Yeah, look what happened there.
>> Hey, look, if if this makes it that I don't have to spend €140 on another replacement cable for a VR headset, I'm I'm totally fine with that. I don't need them to make money. I don't need me to make money. I just need me to not lose that money.
>> All right. Well, speaking of VR headsets, we're inching closer to the Steam Frame release with a Steam OS manager update. I think Liam over at Gaming on Linux is dreaming here if he thinks that it's coming soon. TM, I think we're going to be waiting just a little while longer. I don't know.
Graeme often said that it was going to be called the Decard before we knew about this. And it it's like he knew because it says the DMI board name is Decard and the variant is Decard. I'm like, where did he get that from? It's not like Steam has got anything to do with Bladeunner, but all of a sudden that name is there. I mean, does is that why he's not here? Has he gone to get one of these units?
Bastard.
>> I think he just made it on a rumors website like 5 years ago or something and they've been working on it all this time.
>> I don't know. He was always pretty adamant about it. He He must know something.
>> Yeah, he's got the inside to start listening to his predictions more.
>> Yeah, he does seemingly do very accurate predictions, doesn't he? Maybe he's a time traveler.
>> It could be. And he's using that time travel to come back and then do predictions on a podcast.
>> I'd say that's not wasted at all.
>> Definitely not. Liam is my son's name and he has been saving like a madman.
And well, depending on how much it costs, he's pretty close.
>> Well, has he got the €1,200 that it's going to cost?
>> It's not going to be 1,200. The Jesus Christ, please don't let it be 1,200 or I'm going to have to shell in so much for that.
>> I was surprised by the price of the Steam Controller. I thought it was going to be way over 100 quid. So, you never know. This might be okay. You are the exact opposite of both Graeme and Will from last week who said, "Oh, I can't believe it was that expensive."
>> No, I just I think all of the Steam stuff seems to me like it's just going to come out and be way out of my price range.
>> Well, they can somewhat subsidize it, can't they? Because of selling games and making money off that, which is basically money for old rope in it, really once you've got the effective monopoly.
>> Yeah. If they consider this worth their money to subsidize so that they take over the platform and get more control, then yeah.
>> Well, they did say that they're not going to subsidize it, but like you're effectively subsidizing it if you sell it at cost or close to cost. So, I don't think they're going to be looking to make masses of profit on the hardware.
So, maybe it won't be maybe it'll be more like 800, but I don't know. My my dreams of it being like, you know, a few hundred are just ridiculous, frankly.
>> Wow. But look at the tech that'll be in it though.
>> Fingers crossed for the Steam machine.
I'm I'm much more excited about the Steam machine.
>> That's just a PC. What's to be excited about?
>> Well, currently my Steam Deck sits under my TV and that's not ideal for sitting under the TV and the Steam machine would be.
>> But you could just build a PC.
>> It'd be noisy. Like they're going to have just sorted all that stuff for me.
It's going to work really well.
>> You just don't like tinkering with hardware.
>> If I touch hardware, it blows up.
>> We've been over this on on Linux Dev Time. You you just love to tinker with software, don't you? You love to write software.
>> Yes.
>> Well, I like to tinker with hardware.
What can I say?
>> Well, thank you. Yes, I would very much like you to build me a PC.
>> Well, you tell me your budget, Eddie, and I'll put it together for you.
>> A budget?
>> Oh, no free PCs then. Oh, wow. Okay.
Wow. That's you told. You give me the money and I'll build you something that's great and runs Linux and Steam and is excellent and is not too noisy, but will ultimately probably be more than a Steam machine because they've got, you know, buying power, economies of scale, etc. >> Exactly. I am so happy with my Steam Deck, even though it's effectively doing the job of a Steam machine. So, I think the Steam Machine is going to be even better.
>> Right. Well, we better get out of here then. Thank you very much for sticking around, Andy. It's been great having you the last couple of episodes. It's been really fun. Thanks for having me again.
>> We'll be back next week when hopefully Will and Graeme will return. Until then, I've been Joe.
>> I've been Phum. And I've been Andy. See you later.
Related Videos
Agentforce NOW AMA: Build with React and Salesforce Multi-Framework
SalesforceDevs
490 views•2026-05-28
How agent o11y differs from traditional o11y — Phil Hetzel, Braintrust
aiDotEngineer
450 views•2026-05-28
Re: 🗣️📍theprophedu📍2026 GST 103 CLASS (E-EXAM REVISION)
theprophedu
636 views•2026-06-04
WEB TECHNOLOGIES UNIT-2 | Degree 4th sem BCOM Computers web technologies unit-2 full explanation💯✅
LearnwithSahera
1K views•2026-05-29
More tests are always better? How to use AI to identify tests that bring little value
Alliance4Qualification
335 views•2026-05-29
Search Algorithms Explained in 60 Seconds! 🤖💨
samarthtuliofficial
218 views•2026-06-01
People of Game of Thrones using JavaScript DOM
AltCampus
296 views•2026-05-30
Introduction to Problem Solving Part - 1 | Lecture 1 | Intermediate DSA
ascensionix
107 views•2026-05-29











