4 ms·
How do you know the other compiler is "clean"? That just begs the question. Also, different compilers could produce different, equally valid instructions, such
by henning 5y ago
How do you know the other compiler is "clean"? That just begs the question. Also, different compilers could produce different, equally valid instructions, such as debug vs. release builds.
There are malware analysts who are good at finding sophisticated malware in binaries. They could probably locate suspicious code that could be obfuscated malicious code.
Other than that, if you can't trust any of the compiler vendors (which makes things like checksums on an HTTPS website useless), you'll have to write your own. What about the firmware of the machine you're writing your clean code on? Taking this argument to its logical conclusion makes the idea of developing even simple software astronomically expensive.
- trinovantes 5y agoThis is why I think some things in life should not be digitized e.g. electronic voting. Nobody can realistically know if all of the components from hardware to software is clean. And the more technical you are, the more you realize how many attack surfaces there are. It's impossible to verify everything and you just have to blindly trust that it's all safe.
- willis936 5y agoI can see a high tech future where the only work left for humans is voting and auditing.
- prettyStandard 5y agoYour not wrong, but that's why I mentioned reviewing the assembly. You cross compile to detect the issue, inspect to confirm the issue. This is my primary issue with closed source software, binary blobs, etc; trust.
- cortesoft 5y agoWhat are you using to inspect the assembly? Something compiled!
- mindslight 5y ago> How do you know the other compiler is "clean"? You assert that the other compiler won't contain the exact same backdoor, not that it contains no backdoor. > different compilers could produce different, equally valid instructions, such as debug vs. release builds The binaries you're comparing are output by two instances of the same compiler codebase (each instance created by a different compiler). So as long as that compiler is deterministic, each run should have the exact same output.