The Recursive Sandbox of Trust in Software Security
Description
A screenshot of a comment thread from a platform like Reddit, set against a dark background with white text. The thread discusses the challenge of trusting software. The first comment points out the security gap: "You can't really link to source code as proof the program is safe when you distribute it as a binary." A second user replies with a verification method: "I ran it in a sandbox and decompiled it, the binary is safe." A third user introduces a layer of human distrust: "Yeah but how can I trust you, what if you're a double agent". The final comment delivers the punchline by applying the technical solution to the human problem: "I ran him in a sandbox, he's safe." This meme humorously illustrates the recursive and often absurd nature of establishing trust in cybersecurity, where every layer of verification can itself be questioned. It's a joke that resonates with developers familiar with security audits, dependency vetting, and the philosophical 'who watches the watchers' dilemma
Comments
38Comment deleted
The new security protocol is clear: every pull request must be reviewed by two engineers, and both reviewers must be run in a clean, isolated sandbox environment before their LGTM is considered valid
“Sure, the binary passed the sandbox, the sandbox passed the audit, and the audit bot passed CI - now can someone sandbox the person who built the compiler or do we just rename the project ‘Trusting-Trust-as-a-Service’?”
This is basically the software supply chain version of "it's turtles all the way down" except each turtle is running in a VM that might be compromised by the turtle below it
This perfectly captures the fundamental problem with trust in software supply chains: it's turtles all the way down, except each turtle needs its own sandbox. The real question is who's sandboxing the sandbox runtime? Spoiler: it's probably running in a container orchestrated by Kubernetes, which means we've just added seven more layers of 'trust me bro' to the stack
Zero-trust by recursion: sandbox the binary, sandbox the reviewer - when the trust stack overflows, maybe try signatures
Zero-trust evolution: sandbox the code today, the contributor tomorrow - reproducible builds optional
When your TCB is “I sandboxed the guy who sandboxed the binary,” you’ve reinvented recursive trust - reproducible builds with attestations would be cheaper than infinite VMs
If one of them is run by a sandbox authority and he/she is safe, then the problem's resolved Comment deleted
what if 🧑? Comment deleted
he said ONE of them Comment deleted
he/she -> they he -> that person Comment deleted
Based. Reject this liberal bullshit with pronouns. Comment deleted
Cringe. Respect everyone's pronouns. ("How to use" guide is expected to be provided in case of non-well-known pronouns) Comment deleted
What? "They" is well-known pronoun and refers to a group of people or object which were previously mentioned, not to one person. Comment deleted
Singular they - Wikipedia | en.wikipedia.org Singular they, along with its inflected or derivative forms, them, their, theirs and themselves (or themself), is an epicene (gender-neutral) third-person pronoun. It typically occurs with an unspecified antecedent, in sentences such as: "Somebody left their umbrella in the office. Could you please let them know where they can get it?". "The patient should be told at the outset how much they will be required to pay.". "But a journalist should not be forced to reveal their sources.". ⚡️Instant View Comment deleted
Ok, this is legit but it applies only if we don't know anything about the person. You can't ask to refer to you as "they", as you aren't unknown to those who mention you. Comment deleted
I can, and I don't need any reasons to do this Comment deleted
And you don't have any reasons to do this. Of course you can, but it would be illiterate and generally dumb. Comment deleted
Using ungendered language is not dumb - because using wrong gendered one hurts a lot Comment deleted
And pronouns are chosen by every person individually and it's only their choice. No one should talk a person into changing pronouns Comment deleted
reminder that native speakers define the standard, not the other way around. If the language changes, dictionaries have to reflect the changes. Comment deleted
waiting for "C++ native speaker" /hj Comment deleted
"they" can be used as a gender-neutral singular 3rd person pronoun (referring to one person as in "he" or "she") Comment deleted
oh btw ur a faggot, plus it aint even my opinion/ur irrelevant/ fatherless Absolute fucking retard/braindead, Comment deleted
Bro let them live their life. How's that your concern? Lmao Comment deleted
Oh yes most definitely, I do wish him a happy life. But since he chose the path of liking men, I wanted to educate him on that Comment deleted
based + ratio, or whatever twitterfags say Comment deleted
If I chose you on a date ur paying for my : i’ll have two number 9s, a number 9 large, a number 6 with extra dip, a number 7, two number 45s, one with cheese, and a large soda. Comment deleted
Big smoke's here Comment deleted
I wonder, would the same version of compiler produce the same binary if target OS and arch are the same? Comment deleted
It's called reproducible builds… and it's tough problem. Ideally yes. And software distributions like Guix or F-droid provide a way to cross-check the outputs by independent build providers. But in general convincing people it's worth the effort of making sure their builds are reproducible is hard. Especially if Google has been involved in the ecosystem at large (Go, Android, …) there's usually so many layers of dependencies that it's hard to tackle. Comment deleted
👍 though not sure why you believe it’s hard to convince. The projects where security doesn’t matter, sure. For those where security matters, it’s rather natural to desire rep builds. The issue though I guess depends more on the build tooling (if it supports easy RB), rather than the desire of the devs of a particular project. In theory it’s possible to have RB always enabled in the compiler/linker, so the devs don’t have a choice at all (or would have to explicitly opt-out). Comment deleted
Bruh 🤪 Comment deleted
uh oh something's comin Comment deleted
Such a cute doggo lemme pat Comment deleted
I like how 10% of comments are about code and 90% are about trans shit Comment deleted
only if you count insults towards lgbtq people and them defending themselves Comment deleted
Can't we just write program that receives another text or binary as parameter and checks if it is OK. And to proof that this programm is OK we feed itself into it and voila. 😃😉 Comment deleted