Despite being a pragmatist, it’s fun to imagine what’s possible as a thought experiment: You’re a western signals intelligence agency with virtually unlimited

Despite being a pragmatist, it’s fun to imagine what’s possible as a thought experiment: You’re a western signals intelligence agency with virtually unlimited budget and access to some of the brightest mathematical minds on the planet. Your goal is to evaluate the viability in systemic compromise of virtually all compiler infrastructure used in modern computing to the point where verifiability becomes all but impossible, as theorized in the article. How would you even go about that? What would the modifications look like? How much foresight would you need? Is it even a worthwhile goal, let alone a feasible one? In practice, you’re probably just going to compromise the proprietary platform security modules instead. There, you can use undercover or otherwise sanctioned employees at semiconductor companies backed up by offensive cyber on a continuous basis. From that offensive vantage point, you’re able to compromise most compilers in use today. If those miraculous Mes binaries devoid of any available source were in fact compromised, I suspect at best they’d be relics of a chess game that started long ago and is still being played today, with the binaries themselves no longer relevant. Rather than some deliciously diabolical compromise at the lowest levels of the software stack from which all further compromise flows (a single turtle), a more pragmatic view might hold that systemic compromise may be more akin to architecting turtle contagions and ensuring their continuous delivery. Compilers are just one vector in achieving that end. An even more pragmatic view might hold systemic compiler compromise (i.e. compilers indiscriminately compromising other compilers) is not undertaken for all manner of reasons.