5 ms·

Was there ever a big, significant backdoor in any widely used open source software? I don't mean a bug like heartbleed, but an actual intentional backdoor.

• dsr_ 9y ago
  https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp... (Reflections on Trusting Trust)
  • simias 9y ago
    Still completely theoretical though, at least as far as I know.
    • Jach 9y ago
      And has a counter anyway: https://www.dwheeler.com/trusting-trust/ https://www.dwheeler.com/trusting-trust/
      • guipsp 9y ago
        It only has a counter assuming you have trusted compiler.
        • Jach 9y ago
          Do you trust yourself? You can choose whatever compiler(s) you want as the 'trusted' one(s), even writing your own. It doesn't even need to be a very good or complete compiler.
          • guipsp 9y ago
            What do you compile the trusted compiler with?
            • Jach 9y ago
              Who says it needs to be compiled? Your trusted compiler can be a Basic script. The dissertation likely addresses all your concerns. Sticking with the Basic example, say you wanted to see if tcc was vulnerable, but you don't trust gcc, icc, borland, clang, etc. either as compilers to use directly or as compilers to compile your trusted one.. And you don't want to write your own in Java or Python because you don't trust the VMs. Whip out an Altair BASIC binary from the 70s and write your compiler with that, just enough to compile tcc. Perform DCC. If the tcc source does not correspond with its binary, you'll know.
  • deleted 9y ago
    [deleted]