7 ms·

The "bootstrapable.org" project that OP refers to is an interesting practical result from the infamous "Reflections on Trusting Trust."[1] If you have the sourc

by rusbus 8y ago

The "bootstrapable.org" project that OP refers to is an interesting practical result from the infamous "Reflections on Trusting Trust."[1] If you have the source compiler, which is itself bootstrapped from source, then you effectively sidestep the problem brought up in the paper -- someone sneaks in a boobytrapped compiler somewhere in the process resulting in a chain of tainted compilers. This is the kind of work that seems pretty thankless, but I'm glad someone is doing it. [1] https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p7...

WalterGR 8y ago
If you have the source compiler, which is itself bootstrapped from source, then you effectively sidestep the problem brought up in the paper How does this work? Is the source compiler bootstrapped from its source, such that the source compiler compiles the source of the source compiler and that results in the source compiler? I think I’m getting confused because “source compiler” describes what a compiler does anyway, so I’m guessing that “source” in “source compiler” is used as in origin and not as in textual code, rather than a redundancy? So which source is the source compiler compiling?
- coldtea 8y ago
  The source compiler could be in assembler, for one.
  - WalterGR 8y ago
    Compiling or assembling, how does this work around the problem described in Reflections on Trusting Trust?
    - Cyph0n 8y ago
      I don’t see it either. The paper specifically talked about modifying the source of the “root” compiler, and then using it to compile the system compiler. This can be generalized to N compilers, so to truly claim that your compiler is safe, you’ll need to verify the source of all compilers in the chain. I’m not an expert, so please correct me if I’m off here!
      - coldtea 8y ago
        Assembler is pretty trivial to translate to machine code (and can be even written so that it's 1 to 1 per line). Theoretically (not very practical due to size) you could translate the compiler text that you see to machine executable code yourself, looking at some opcode reference.
        WalterGR 8y ago
        While that’s true, I don’t believe that’s the approach we’re discussing here.
        WalterGR 8y ago
        Apologies, maybe that is the approach we’re talking about here, and I’ve simply confused myself. :) OP: If you have the source compiler, which is itself bootstrapped from source, then you effectively sidestep the problem brought up in the paper. So does that translate to English as: You have the source code for a compiler. You’ve ensured that the source code isn’t tainted in any way. If you translate that source code into an executable binary by hand, then you know that binary isn’t tainted. And subsequently, that binary won’t taint its output. ? Hmm. That just doesn’t seem interesting. And, as you say, “Theoretically... you could...”. Emphasis mine...
      - WalterGR 8y ago
        I think I’ve resolved my confusion (see my updated response to coldtea.) I think you’re 100% correct. This result just doesn’t seem interesting. Not only do you have to verify the source of all compilers in the chain, you need to ensure that - when that code is compiled - it’s the exact source that was verified. And even then, how do you know that the disk firmware actually gives you that non-tainted compiler when you ask for it? But: I guess it’s turtles all the way down. This at least theoretically improves how much of the chain (from atoms on a disk to the binaries produced by your Nth compiler) is non-tainted.
      - pygy_ 8y ago
        Don't forget the CPU, which can also be malicious. That being said, that problem can be worked around by throwing interpreters into the mix.
colejohnson66 8y ago
“someone sneaks in a boobytrapped compiler somewhere...” Especially one that spits out a white supremacy message every once in a while: https://www.quora.com/What-is-a-coders-worst-nightmare/answer/Mick-Stute https://www.quora.com/What-is-a-coders-worst-nightmare/answe...
- unhammer 8y ago
  Wow. But it sounds almost too good to be true; anyone know if it's for real?
  - Drdrdrq 8y ago
    I have no idea if it's true, but it is really not that difficult to achieve in a setting like this, where binaries are compiled from the sources that are available on the system itself. Even creating a compiler that poisons itself is not that difficult. It is the idea itself which is genius, and (unfortunately) completely doable.
WalterGR 8y ago
The "bootstrapable.org" project that OP refers to... “Strappable” has 2 P’s... Link: https://bootstrappable.org/ https://bootstrappable.org/

by rusbus 8y ago

WalterGR 8y ago

If you have the source compiler, which is itself bootstrapped from source, then you effectively sidestep the problem brought up in the paper How does this work? Is the source compiler bootstrapped from its source, such that the source compiler compiles the source of the source compiler and that results in the source compiler? I think I’m getting confused because “source compiler” describes what a compiler does anyway, so I’m guessing that “source” in “source compiler” is used as in origin and not as in textual code, rather than a redundancy? So which source is the source compiler compiling?

coldtea 8y ago
The source compiler could be in assembler, for one.
- WalterGR 8y ago
  Compiling or assembling, how does this work around the problem described in Reflections on Trusting Trust?
  - Cyph0n 8y ago
    I don’t see it either. The paper specifically talked about modifying the source of the “root” compiler, and then using it to compile the system compiler. This can be generalized to N compilers, so to truly claim that your compiler is safe, you’ll need to verify the source of all compilers in the chain. I’m not an expert, so please correct me if I’m off here!
    - coldtea 8y ago
      Assembler is pretty trivial to translate to machine code (and can be even written so that it's 1 to 1 per line). Theoretically (not very practical due to size) you could translate the compiler text that you see to machine executable code yourself, looking at some opcode reference.
      - WalterGR 8y ago
        While that’s true, I don’t believe that’s the approach we’re discussing here.
        WalterGR 8y ago
        Apologies, maybe that is the approach we’re talking about here, and I’ve simply confused myself. :) OP: If you have the source compiler, which is itself bootstrapped from source, then you effectively sidestep the problem brought up in the paper. So does that translate to English as: You have the source code for a compiler. You’ve ensured that the source code isn’t tainted in any way. If you translate that source code into an executable binary by hand, then you know that binary isn’t tainted. And subsequently, that binary won’t taint its output. ? Hmm. That just doesn’t seem interesting. And, as you say, “Theoretically... you could...”. Emphasis mine...
    - WalterGR 8y ago
      I think I’ve resolved my confusion (see my updated response to coldtea.) I think you’re 100% correct. This result just doesn’t seem interesting. Not only do you have to verify the source of all compilers in the chain, you need to ensure that - when that code is compiled - it’s the exact source that was verified. And even then, how do you know that the disk firmware actually gives you that non-tainted compiler when you ask for it? But: I guess it’s turtles all the way down. This at least theoretically improves how much of the chain (from atoms on a disk to the binaries produced by your Nth compiler) is non-tainted.
    - pygy_ 8y ago
      Don't forget the CPU, which can also be malicious. That being said, that problem can be worked around by throwing interpreters into the mix.

colejohnson66 8y ago

“someone sneaks in a boobytrapped compiler somewhere...” Especially one that spits out a white supremacy message every once in a while: https://www.quora.com/What-is-a-coders-worst-nightmare/answer/Mick-Stute https://www.quora.com/What-is-a-coders-worst-nightmare/answe...

unhammer 8y ago
Wow. But it sounds almost too good to be true; anyone know if it's for real?
- Drdrdrq 8y ago
  I have no idea if it's true, but it is really not that difficult to achieve in a setting like this, where binaries are compiled from the sources that are available on the system itself. Even creating a compiler that poisons itself is not that difficult. It is the idea itself which is genius, and (unfortunately) completely doable.

WalterGR 8y ago

The "bootstrapable.org" project that OP refers to... “Strappable” has 2 P’s... Link: https://bootstrappable.org/ https://bootstrappable.org/