6 ms·

You're actually implying that you can't trust any computer with the code you are telling it to execute. This is an exaggeration IMO. Sure you can have backdoors

You're actually implying that you can't trust any computer with the code you are telling it to execute. This is an exaggeration IMO. Sure you can have backdoors and hacks, but with what probability? On the other hand, users need to put their trust in humans, not computers.

xav0989 6y ago
Ken Thompson wrote a paper about trust that was published in ACM in '84 entitled "Reflections on Trusting Trust". He makes the case for a trojan that could be built in such a way that it would infect a compiler, self-replicate into new versions of the compiler, and inject itself into specific binaries; all without appearing in the source code of the new versions of the compiler or the target binary. Arguably, the probability of such an attack is extremely low--slim to none might be an overstatement--but it's an interesting thought exercise.
- IggleSniggle 6y ago
  I remember reading about this attack being implemented and executed in a university system decades ago. Perhaps apocryphal, but it didn’t seem that way.
  - SifJar 6y ago
    You're possibly thinking of this: https://www.quora.com/What-is-a-coders-worst-nightmare/answer/Mick-Stute https://www.quora.com/What-is-a-coders-worst-nightmare/answe...
    - IggleSniggle 6y ago
      That's the one!
- david_draco 6y ago
  All the godbolt users looking at their binaries from various compilers would quickly notice this, I think.
  - jhardy54 6y ago
    It doesn't need to go in every binary, the conventional attack only outputs the malware when it's compiling a compiler or sudo (or something).
- coddle-hark 6y ago
  For what it’s worth you can detect a “trusting trust” attack using Diverse Double Compiling. David A. Wheeler implemented it as part of his dissertation back in 2009 and verified that gcc had not been infected. https://dwheeler.com/trusting-trust/ https://dwheeler.com/trusting-trust/
  - im3w1l 6y ago
    I read the abstract and it seems kind of obvious: Yes if you have a trusted compiler you can bootstrap another. But have can we know the "trusted compiler" is really to be trusted?
munchbunny 6y ago
This is the classic conundrum when thinking about supply chain attacks. It can happen, but at what probability threshold do you stop trying to take security measures? On the other hand, users need to put their trust in humans, not computers. It’s still a human trust problem all the way down because you had to buy your computer from someone, and they had to buy the parts from someone, and so on. There are some places where it’s less of an issue due to cryptographic magic, but those are few and far between.

xav0989 6y ago

Ken Thompson wrote a paper about trust that was published in ACM in '84 entitled "Reflections on Trusting Trust". He makes the case for a trojan that could be built in such a way that it would infect a compiler, self-replicate into new versions of the compiler, and inject itself into specific binaries; all without appearing in the source code of the new versions of the compiler or the target binary. Arguably, the probability of such an attack is extremely low--slim to none might be an overstatement--but it's an interesting thought exercise.

IggleSniggle 6y ago
I remember reading about this attack being implemented and executed in a university system decades ago. Perhaps apocryphal, but it didn’t seem that way.
- SifJar 6y ago
  You're possibly thinking of this: https://www.quora.com/What-is-a-coders-worst-nightmare/answer/Mick-Stute https://www.quora.com/What-is-a-coders-worst-nightmare/answe...
  - IggleSniggle 6y ago
    That's the one!
david_draco 6y ago
All the godbolt users looking at their binaries from various compilers would quickly notice this, I think.
- jhardy54 6y ago
  It doesn't need to go in every binary, the conventional attack only outputs the malware when it's compiling a compiler or sudo (or something).
coddle-hark 6y ago
For what it’s worth you can detect a “trusting trust” attack using Diverse Double Compiling. David A. Wheeler implemented it as part of his dissertation back in 2009 and verified that gcc had not been infected. https://dwheeler.com/trusting-trust/ https://dwheeler.com/trusting-trust/
- im3w1l 6y ago
  I read the abstract and it seems kind of obvious: Yes if you have a trusted compiler you can bootstrap another. But have can we know the "trusted compiler" is really to be trusted?

munchbunny 6y ago

This is the classic conundrum when thinking about supply chain attacks. It can happen, but at what probability threshold do you stop trying to take security measures? On the other hand, users need to put their trust in humans, not computers. It’s still a human trust problem all the way down because you had to buy your computer from someone, and they had to buy the parts from someone, and so on. There are some places where it’s less of an issue due to cryptographic magic, but those are few and far between.