4 ms·
For what it’s worth you can detect a “trusting trust” attack using Diverse Double Compiling. David A. Wheeler implemented it as part of his dissertation back in
by coddle-hark 6y ago
For what it’s worth you can detect a “trusting trust” attack using Diverse Double Compiling. David A. Wheeler implemented it as part of his dissertation back in 2009 and verified that gcc had not been infected.
https://dwheeler.com/trusting-trust/ https://dwheeler.com/trusting-trust/
- im3w1l 6y agoI read the abstract and it seems kind of obvious: Yes if you have a trusted compiler you can bootstrap another. But have can we know the "trusted compiler" is really to be trusted?