5 ms·
So if you want to avoid trusting trust, you need to audit not only a C compiler and the source code for the Go compiler you plan on using, but also every past G
by cperciva 12y ago
So if you want to avoid trusting trust, you need to audit not only a C compiler and the source code for the Go compiler you plan on using, but also every past Go compiler as well?
- f2f 12y agoYou can't avoid trusting trust. "Ken was here" :)
- sanxiyn 12y agoYou actually can. Proof here: http://www.dwheeler.com/trusting-trust/ http://www.dwheeler.com/trusting-trust/
- f2f 12y agoI was alluding to Ken being the author of the old, as well as one of the authors of the new compiler. In jest :)
- cperciva 12y agoYou can. You just have to bootstrap all the way up.
- deleted 12y ago[deleted]
- fugyk 12y agoWhat if any intermediate version is found to contain the violation of trusting trust? Every go maintainer has to build every version sequentially from that version to current version.
- sesutton 12y agoYou could audit the Go source and then use the diverse double compiling technique[0] to verify that the binary you're using corresponds to that source code. [0] http://www.dwheeler.com/trusting-trust/dissertation/html/wheeler-trusting-trust-ddc.html http://www.dwheeler.com/trusting-trust/dissertation/html/whe...
- cperciva 12y agoYou mean, audit a large number of independently-written Go compilers?
- indians_pro 12y agoNicely done. To be fair though, Go is just 6 years old and still evolving.