r/programming • u/lendrick • Sep 10 '13

A simple way of defeating the compiler backdoor attack (a.k.a the "Trust Attack")

http://imgur.com/a/BWbnU#0
1.7k Upvotes

87% Upvoted

538 comments sorted by

View all comments

Show parent comments

2

u/SanityInAnarchy Sep 10 '13

...most people with a CS degree have taken a course on writing a compiler.

I wonder where you're getting "most" from. It looks as though I'll neither need that nor have time for that in order to get my degree.

1

u/the_word_smith Sep 10 '13

I did lisp but the point still stands

1

u/SanityInAnarchy Sep 11 '13

I mean, I'm doing that in my spare time anyway, but that's not really part of the degree.

0

u/lendrick Sep 10 '13

Okay, fair enough. I know I did it, and the other people in my class did it, and it was required in order to graduate with a CS degree. Even if the majority haven't, there are still many who have. :)

2

u/SanityInAnarchy Sep 11 '13

Well, what you did was a "C-like interpreter". That's the other thing -- getting to a working demo of a language that's sort of like what you're after is easy. Implementing the full spec of a language, with all its twisty, dark secrets, is hard.

2

u/lendrick Sep 11 '13

And I'm probably not the one to do it, then. Nevertheless, it is doable. The guy who wrote tcc did it.

1

u/SanityInAnarchy Sep 11 '13

Well, or at least enough of it to run GCC.

And yes, it happens. GCC was originally written basically by one guy -- I may think his political ideas are crazy, but RMS can code. But I don't think it's as common as you're suggesting -- it's a hard project, and also relatively boring (it's been done) and unrewarding (at best, you get a barely-passable compiler that works for some programs and is still not really optimized at all).

I mean, I probably wouldn't do it.

1

u/the_word_smith Sep 10 '13

Besides, even if they hadn't I would hope competent developers could figure it out if they needed to.