3 ms·

> everything you don't have source to is compromised. Everything for which you haven't read, fully understood, and compiled from the source can be compromised

> everything you don't have source to is compromised. Everything for which you haven't read, fully understood, and compiled from the source can be compromised. Just because there's source for something somewhere doesn't mean the binary you downloaded is secure.

zelon88 7y ago
Relevant... [1] > Ken describes how he injected a virus into a compiler. Not only did his compiler know it was compiling the login function and inject a backdoor, but it also knew when it was compiling itself and injected the backdoor generator into the compiler it was creating. The source code for the compiler thereafter contains no evidence of either virus. [1]https://wiki.c2.com/?TheKenThompsonHack https://wiki.c2.com/?TheKenThompsonHack
- clachance 7y ago
  This has always impressed me, I'd love to peek the code and try to read it but I highly doubt I'd be proficient enough to understand it.
  - deleted 7y ago
    [deleted]
Denvercoder9 7y ago
Make sure you've also read, understood and recompiled the compiler. And the compiler used to compile the compiler.
- supercommand 7y ago
  Even then, assembly is too high level. https://m.youtube.com/watch?v=eunYrrcxXfw https://m.youtube.com/watch?v=eunYrrcxXfw And then we get into hardware design... https://m.youtube.com/watch?v=_eSAF_qT_FY https://m.youtube.com/watch?v=_eSAF_qT_FY
- colejohnson66 7y ago
  That reminds me of an answer on Quora where a compiler was infected and would insert white supremacy messages into the compiled program. And if you tried to recompile the compiler, it would inject its code into the new compiler[0]. [0]: http://www.quora.com/What-is-a-coders-worst-nightmare/answer/Mick-Stute http://www.quora.com/What-is-a-coders-worst-nightmare/answer...
colejohnson66 7y ago
Because open source projects like OpenSSL never have bugs sitting wide open for years. cough Heartbleed

zelon88 7y ago

Relevant... [1] > Ken describes how he injected a virus into a compiler. Not only did his compiler know it was compiling the login function and inject a backdoor, but it also knew when it was compiling itself and injected the backdoor generator into the compiler it was creating. The source code for the compiler thereafter contains no evidence of either virus. [1]https://wiki.c2.com/?TheKenThompsonHack https://wiki.c2.com/?TheKenThompsonHack

clachance 7y ago
This has always impressed me, I'd love to peek the code and try to read it but I highly doubt I'd be proficient enough to understand it.
- deleted 7y ago
  [deleted]

Denvercoder9 7y ago

Make sure you've also read, understood and recompiled the compiler. And the compiler used to compile the compiler.

supercommand 7y ago
Even then, assembly is too high level. https://m.youtube.com/watch?v=eunYrrcxXfw https://m.youtube.com/watch?v=eunYrrcxXfw And then we get into hardware design... https://m.youtube.com/watch?v=_eSAF_qT_FY https://m.youtube.com/watch?v=_eSAF_qT_FY
colejohnson66 7y ago
That reminds me of an answer on Quora where a compiler was infected and would insert white supremacy messages into the compiled program. And if you tried to recompile the compiler, it would inject its code into the new compiler[0]. [0]: http://www.quora.com/What-is-a-coders-worst-nightmare/answer/Mick-Stute http://www.quora.com/What-is-a-coders-worst-nightmare/answer...

colejohnson66 7y ago

Because open source projects like OpenSSL never have bugs sitting wide open for years. cough Heartbleed