4 ms·
even if you compile yourself you can't be sure. [Reflections on Trusting Trust ](https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingT
by gengear 4y ago
even if you compile yourself you can't be sure. [Reflections on Trusting Trust ](https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...)
- 5d8767c68926 4y agoHas that attack ever been observed in the wild? While I don't know if the current incarnations of Nix/Guix will succeed, I think we are slowly making progress towards reproducible builds everywhere.
- whydoyoucare 4y agoNo one knows for sure, though compromised compilers are not far fetched - there has been an implicit trust on compiler toolchains. Reproducible builds are a few years out from full general adoption.
- LtWorf 4y agoAssembly code can be read to see if it matches.
- marcodiego 4y ago> Has that attack ever been observed in the wild? Yes: https://www.quora.com/What-is-a-coders-worst-nightmare/answer/Mick-Stute https://www.quora.com/What-is-a-coders-worst-nightmare/answe... Also, I remember in the 90's, people talking about a virus that infect pascal source code files. Memory is spotty about it. > While I don't know if the current incarnations of Nix/Guix will succeed, I think we are slowly making progress towards reproducible builds everywhere. Fortunately, the answer is also positive here.
- anthk 4y agoNot with Guix and Mes.
- marcodiego 4y agoReproducible builds make an attack like this as likely as "the whole world is a big conspiracy".