3 ms·

To compile to the same bit pattern binary, you'd need the same optimization settings (easy) with the same compiler (harder). Intel can just give the source, bu

by TapamN 9y ago

To compile to the same bit pattern binary, you'd need the same optimization settings (easy) with the same compiler (harder). Intel can just give the source, but you can't trust Intel to just give you the same compiler they used, because the compiler might insert a backdoor. You'd need the compiler source, audit it for backdoors, then compile that with a trustworthy compiler. Then use the resulting compiler to compile the ME source. (Compiler compiler compiler)

wolfgke 9y ago
> You'd need the compiler source, audit it for backdoors, then compile that with a trustworthy compiler. Then use the resulting compiler to compile the ME source. It is possible (though somewhat time-intensive) to audit binaries, too. If there is real demand for this, it should be possible to crowdscale the auditing problem over a large group of OSS enthusiasts.
- hdhzy 9y ago
  Auditing binaries wouldn't really do anything as it's their hardware that'd run the binary. So the hardware can be programmed to lie or to still have some backdoor.
bloodorange 9y ago
Your comment reminds me of Ken Thompson's speech which he gave upon receiving the Turing Award: https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html (Reflections on Trusting Trust)
- tehwalrus 9y ago
  The comparison between a person administering an unsecured computer network and a drunk driver has just made my list of legal IT analogies, along side BitTorrent being a car that might be used as the getaway vehicle in a robbery. Thanks, I really enjoyed reading it!
lorenzhs 9y ago
Reproducible builds are possible. Something like 94% of debian now builds reproducibly: https://tests.reproducible-builds.org/debian/stretch/index_suite_amd64_stats.html https://tests.reproducible-builds.org/debian/stretch/index_s... and there's a post on reproducibility in Arch on the front page right now: https://news.ycombinator.com/item?id=15820356 https://news.ycombinator.com/item?id=15820356. Signal for Android builds reproducibly, too: https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/ Of course that only helps if you trust the toolchain.

by TapamN 9y ago

wolfgke 9y ago

> You'd need the compiler source, audit it for backdoors, then compile that with a trustworthy compiler. Then use the resulting compiler to compile the ME source. It is possible (though somewhat time-intensive) to audit binaries, too. If there is real demand for this, it should be possible to crowdscale the auditing problem over a large group of OSS enthusiasts.

hdhzy 9y ago
Auditing binaries wouldn't really do anything as it's their hardware that'd run the binary. So the hardware can be programmed to lie or to still have some backdoor.

bloodorange 9y ago

Your comment reminds me of Ken Thompson's speech which he gave upon receiving the Turing Award: https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html (Reflections on Trusting Trust)

tehwalrus 9y ago
The comparison between a person administering an unsecured computer network and a drunk driver has just made my list of legal IT analogies, along side BitTorrent being a car that might be used as the getaway vehicle in a robbery. Thanks, I really enjoyed reading it!

lorenzhs 9y ago

Reproducible builds are possible. Something like 94% of debian now builds reproducibly: https://tests.reproducible-builds.org/debian/stretch/index_suite_amd64_stats.html https://tests.reproducible-builds.org/debian/stretch/index_s... and there's a post on reproducibility in Arch on the front page right now: https://news.ycombinator.com/item?id=15820356 https://news.ycombinator.com/item?id=15820356. Signal for Android builds reproducibly, too: https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/ Of course that only helps if you trust the toolchain.