4 ms·
> It's pretty easy [...] to avoid this kind of detection. And by rice's theorem, it is generally undecidable whether there are hidden modules loaded. Static (
by maweki 4y ago
> It's pretty easy [...] to avoid this kind of detection.
And by rice's theorem, it is generally undecidable whether there are hidden modules loaded.
Static (or in this case maybe not so static) analysis of arbitrary code will never lead to 100% safety. You'll always need some static restrictions on what code you're even allowed to write.
- janalsncm 4y agoComing at this from a naive perspective, do we care if a module is provably, definitely imported? I think for supply chain attacks it should be sufficient to say this module might be imported and deserves attention. I assume Rice’s theorem would also say that even though malicious code is imported it might not run the malicious bits today or on this machine [1]. But that doesn’t mean I’m ok with having it there. [1] https://en.m.wikipedia.org/wiki/Stuxnet https://en.m.wikipedia.org/wiki/Stuxnet
- maweki 4y agoIt's undecidable whether there even is an import of stuff. It's every non-trivial property that's undecidable. So the question whether a certain line is reached is as undecidable as the question what values can arguments have at that line. So it's undecidable whether a dynamic import statement is reached and what its import argument will be. And even if the value is static, then it's undecidable whether the content of the imported module has been just changed.