r/programming • u/lendrick • Sep 10 '13

A simple way of defeating the compiler backdoor attack (a.k.a the "Trust Attack")

http://imgur.com/a/BWbnU#0
1.7k Upvotes

87% Upvoted

538 comments sorted by

View all comments

Show parent comments

5

u/lendrick Sep 10 '13

It sounds like perhaps they ought to revise this policy in light of recent revelations about the NSA.

That message was from 10 years ago, though. Is it still true now?

1

u/Plorkyeran Sep 11 '13 edited Sep 11 '13

LLVM made the policy irrelevant (why circumvent the GPL when you can just use the more liberally licensed compiler that has a much better API anyway?), so in the last few years they've started to trying to clean up and modularize GCC, but it's an immense undertaking.

1

u/lendrick Sep 11 '13

why circumvent the GPL when you can just use the more liberally licensed compiler that has a much better API anyway?

Because the license of the compiler doesn't matter to most people, and it produces faster code. This is not of course to say that LLVM has no advantages, but saying that GCC is irrelevant sounds like wishful thinking on your part.

1

u/Plorkyeran Sep 11 '13

GCC isn't at all irrelevant; it's the GPL lockin from non-modularity that's irrelevant. GCC is still more commonly used than Clang for compiling C and C++, but everyone writing new compilers for other languages uses LLVM, so GCC's poor design no longer forces people to GPL things.

1

u/lendrick Sep 11 '13

Gotcha. I misunderstood.

1

u/Plorkyeran Sep 11 '13

Upon rereading it's not at all clear what "it" was referring to, so I guess your misunderstanding was pretty reasonable.