The Illusion of Control: Trusting Software in the Age of Compromise#

Moin Rahman — Independent consultant / FreeBSD contributor

• Why: Not a networking talk at all — but it takes the "zero trust" idea the network world lives by and applies it to the software supply chain that builds the network stack (OS images, NOS builds, tooling). That framing — you don't control your security if you don't control your build — is a genuine signal of where infrastructure trust is heading.
• What: An argument that the drift from DIY source builds (LFS, Gentoo, BSDs) to package managers and now CI/CD pipelines created "assumed, not verified" security, illustrated with SolarWinds, XZ, and CCleaner. The proposal is "Zero Trust Builds": trusted source selection, reproducible builds, isolated build environments, cryptographic verification of every step. Includes a concrete catalogue of what breaks reproducibility (timestamps, non-deterministic compilation, hardcoded paths, embedded UUIDs, locale sensitivity, unpinned internet dependencies) and what upstream developers should do about it (SOURCE_DATE_EPOCH, fixed seeds, pinned dependencies, diffoscope checks), plus the state of reproducible-build testing across Debian, FreeBSD, OpenBSD, NixOS, and others. A memorable demo point: github.com/freebsd vs github.com/free6sd — one character off, full pipeline compromise.
• How: Deterministic/reproducible builds verified by byte-for-byte comparison, hardened isolated pipelines, and independent verification of vendor artifacts rather than trusting signatures alone ("signed binaries ≠ secure binaries").
• Where applicable: General — applies to any organization's software supply chain, and by extension to how you trust the firmware and NOS images running your network. The speaker is an independent FreeBSD contributor, not a vendor; the content is a practice guide, not a pitch. Based on the slide deck (no abstract was published).