I'm here today to talk to you about
diffoscope

and how you can use it as a better diff

or for Quality Assurance, etc., things
like that.

Moin!

Apparently that's like a north german
thing to say "welcome".

North german, north Denmark, Scandinavia,
that kind of thing, I'm told.

People are shaking their head, so I'm
going to assume that's true.

This is my first PC, an IBM 5155.

Sometimes, when you rebooted it, it would
launch into, it would somehow revert

from booting from the hard disk to booting
from a basic ROM,

as in the programming language ROM.

It was on my motherboard for some reason.

So, randomly, you just get a chance to
program in basic and then,

sometimes you wouldn't, I don't know why,
but… yeah.

It's quite fun with this kind of clicky
keyboard, and that folded in

and it was this kind of big desk thing.

Anyway…

This is my first Debian.

At the time it was already old.

What's this one? Is this Slink? 2.2?
Yeah.

And this is when we had US and non-US,
so that's really dating if you remember that.

This is my first contribution to Debian,
19th December 2006,

sending a patch to lillypond which is kind
of interesting

and the response was "Oh yeah, rock on,
many thanks. I'll upload this and

it'll be landing to Etch".

And this was super motivating because
Etch was just coming out and it was like

"Great, I've got let one line of tiny patch
in a release. This is super cool."

Thomas' response was super motivating.

So, after that, like that Christmas
basically spent ???

Debian webpages and stuff.

Very well timed.

That's kind of a good…

You know, someone sends a patch, be like
"Cool, thanks"

Like a little notice in the changelog.

It was, you know, so stupid but…
Yeah, do that kind of thing.

So, moving on.

Why diffoscope?
Why did we write diffoscope?

What's the background here?

It comes from reproducible builds.

The very quick outline is that once you
get the source code for free software,

you download the source code for nginx
or whatever,

pretty much everyone just runs binaries
on their servers or their systems.

You know, "apt install bla", "yum install",
whatever.

Android Playstore, whatever.

Can you actually trust whether these two
things correspond with each other?

You've gotten the source code, it looks
alright, and then you install this binary,

yeah…

Who generated that? Can you trust that
???

Can you trust who generated it?

Even if you could trust them, could you
trust them not to be exploited? Etc.