4 ms·

This is security Inception. There have been many PoCs for compilers and linkers being modified to then insert backdoors into compiled/linked output. At some po

• mikegerwitz 9y ago
  You're referring to the Thompson hack: https://dl.acm.org/citation.cfm?id=358210 https://dl.acm.org/citation.cfm?id=358210 The system needs to be bootstrapped in such a way that the compiler can be trusted. This may include compiling e.g. gcc through a multi-stage process starting from a simple, easily-audited compiler with a small set of features and working your way up to a full-featured C compiler. It might mean double-compilation---comparing output from multiple compilers. Combining that with reproducible builds, you can (one day) trust your toolchain and your system. Hardware is another story. https://reproducible-builds.org/events/athens2015/bootstrapping/ https://reproducible-builds.org/events/athens2015/bootstrapp... Hopefully this will be all sorted out and standard practice in the near future.