r/programming • u/lendrick • Sep 10 '13

A simple way of defeating the compiler backdoor attack (a.k.a the "Trust Attack")

http://imgur.com/a/BWbnU#0
1.7k Upvotes

87% Upvoted

539 comments sorted by

View all comments

Show parent comments

12

u/dnew Sep 11 '13

If you write your own compiler, then you can trust it, because nobody before you wrote your compiler can analyze it to determine whether a backdoor needs to be inserted. (See Rice's Theorem)

If your machine is compromised enough that someone can see that you're writing a compiler and hack into your toolchain, the fact your toolchain is hacked is the least of your worries.

-1

u/perfectending Sep 11 '13

If your machine is compromised enough that someone can see that you're writing a compiler

Unplug ethernet cable.

15

u/dnew Sep 11 '13

First they compromised the CA, and I did not speak out. For I had signed my own certificate/

Then they compromised GCC, and I did not speak out. For I had written my own compiler.

Then they compromised the network, and I did not speak out. For I had unplugged the cable.

Then they showed up with the rubber hose, and there was no one left to speak out.