4 ms·

Yes, I mention it in the post :)

akkartik 10y ago
Worth linking "diverse double-compiling" there or to some other resource, if I may make the suggestion. For other interested readers: a) html version of David Wheeler's dissertation: http://www.dwheeler.com/trusting-trust/dissertation/html/wheeler-trusting-trust-ddc.html http://www.dwheeler.com/trusting-trust/dissertation/html/whe.... I read it over a week last month, and it made a big impression on me. b) the HN discussion for the Wheeler dissertation: https://news.ycombinator.com/item?id=12666923 https://news.ycombinator.com/item?id=12666923
- Manishearth 10y ago
  Good point, linked!
- tcoppi 10y ago
  Well it looks like this answers the question I posited above. Very interesting work, surprised I hadn't seen it.
- nickpsecurity 10y ago
  As I said there, Wheeler was exemplary for handling most of this right ahead of time. He gave credit to Karger for inventing the compiler subversion attack. He wrote the reference page on high-assurance FLOSS (for compiler verification) and high-assurance SCM (for repo security, esp distribution). He also wrote a cheat I gripe about in reproducible builds to give us something to work with if high-assurance methods get ignored. Any of his stuff on this subject is worth reading. Here's his high-assurance and SCM pages: http://www.dwheeler.com/essays/high-assurance-floss.html http://www.dwheeler.com/essays/high-assurance-floss.html http://www.dwheeler.com/essays/scm-security.html http://www.dwheeler.com/essays/scm-security.html
drvdevd 10y ago
Great writeup! And actually a fun idea for an intro to rust compiler internals. I'll be stepping through this in detail later. It would be extra cool if you had a series and did this with Go as well :)
- Manishearth 10y ago
  Thanks! It shouldn't be hard, and I've played with the Go AST before. I ... could :) This was sort of a bucket list thing though, doing it a second time is less fun :p And I don't have that much time. Why don't you try? The technique explained in the blog post is pretty universal. Go has an AST too, and while the Folder abstraction doesn't exist in its codebase (as far as I know), you can still tweak the AST. In the case of Go it would be easier to do the injection during parsing. https://github.com/golang/go/blob/5c9035acc1e1540a564ea660000f4f64e783d5ac/src/go/parser/parser.go#L2369 https://github.com/golang/go/blob/5c9035acc1e1540a564ea66000... would be a good entry point. https://golang.org/pkg/go/ast/ https://golang.org/pkg/go/ast/ should help. (I am not a Go compiler dev so there may be better entry points)
  - kibwen 10y ago
    > It shouldn't be hard, and I've played with the Go AST > before. I ... could :) Do it! :) Sadly the title is destined to be less fabulous than this one, but given Thompson's association with Go the motivating angle is obvious.
    - drvdevd 10y ago
      Ah yes - I forgot to mention: great title!
  - drvdevd 10y ago
    I think I might as well :) Time is also an issue for me though, but it's not a complete impossibility. I appreciate the tips on starting points. Very interesting. If I do end up doing something like this I will give credit where it's due.

Worth linking "diverse double-compiling" there or to some other resource, if I may make the suggestion. For other interested readers: a) html version of David Wheeler's dissertation: http://www.dwheeler.com/trusting-trust/dissertation/html/wheeler-trusting-trust-ddc.html http://www.dwheeler.com/trusting-trust/dissertation/html/whe.... I read it over a week last month, and it made a big impression on me. b) the HN discussion for the Wheeler dissertation: https://news.ycombinator.com/item?id=12666923 https://news.ycombinator.com/item?id=12666923

Manishearth 10y ago
Good point, linked!
tcoppi 10y ago
Well it looks like this answers the question I posited above. Very interesting work, surprised I hadn't seen it.
nickpsecurity 10y ago
As I said there, Wheeler was exemplary for handling most of this right ahead of time. He gave credit to Karger for inventing the compiler subversion attack. He wrote the reference page on high-assurance FLOSS (for compiler verification) and high-assurance SCM (for repo security, esp distribution). He also wrote a cheat I gripe about in reproducible builds to give us something to work with if high-assurance methods get ignored. Any of his stuff on this subject is worth reading. Here's his high-assurance and SCM pages: http://www.dwheeler.com/essays/high-assurance-floss.html http://www.dwheeler.com/essays/high-assurance-floss.html http://www.dwheeler.com/essays/scm-security.html http://www.dwheeler.com/essays/scm-security.html

drvdevd 10y ago

Great writeup! And actually a fun idea for an intro to rust compiler internals. I'll be stepping through this in detail later. It would be extra cool if you had a series and did this with Go as well :)

Manishearth 10y ago
Thanks! It shouldn't be hard, and I've played with the Go AST before. I ... could :) This was sort of a bucket list thing though, doing it a second time is less fun :p And I don't have that much time. Why don't you try? The technique explained in the blog post is pretty universal. Go has an AST too, and while the Folder abstraction doesn't exist in its codebase (as far as I know), you can still tweak the AST. In the case of Go it would be easier to do the injection during parsing. https://github.com/golang/go/blob/5c9035acc1e1540a564ea660000f4f64e783d5ac/src/go/parser/parser.go#L2369 https://github.com/golang/go/blob/5c9035acc1e1540a564ea66000... would be a good entry point. https://golang.org/pkg/go/ast/ https://golang.org/pkg/go/ast/ should help. (I am not a Go compiler dev so there may be better entry points)
- kibwen 10y ago
  > It shouldn't be hard, and I've played with the Go AST > before. I ... could :) Do it! :) Sadly the title is destined to be less fabulous than this one, but given Thompson's association with Go the motivating angle is obvious.
  - drvdevd 10y ago
    Ah yes - I forgot to mention: great title!
- drvdevd 10y ago
  I think I might as well :) Time is also an issue for me though, but it's not a complete impossibility. I appreciate the tips on starting points. Very interesting. If I do end up doing something like this I will give credit where it's due.