glyph,
@glyph@mastodon.social avatar

If you have not read this paper, you probably should. I don’t have a particular comment but the parallels are obvious and you are probably going to be seeing a lot of experienced security people referencing it in discussions in the coming days

https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf

#liblzma #xz

magical,

@glyph

i would recommend also reading rsc's follow-up article "Running the 'Reflections on Trusting Trust' Compiler" which gives a full line-by-line breakdown of ken's original exploit code, and touches (briefly) on David A. Wheeler's countermeasure, "diverse double compiling"

https://research.swtch.com/nih

zzzeek,
@zzzeek@hachyderm.io avatar

@glyph "More precisely stated, the problem is to write a source program that, when compiled and executed, will
produce as output an exact copy of its source. "

with open(file) as f:
print(f.read())

this is why i fail job interviews

glyph,
@glyph@mastodon.social avatar

@zzzeek because you forgot to use inspect.getsource and thus might get byte code? ;-)

  • All
  • Subscribed
  • Moderated
  • Favorites
  • random
  • DreamBathrooms
  • ngwrru68w68
  • modclub
  • magazineikmin
  • thenastyranch
  • rosin
  • khanakhh
  • InstantRegret
  • Youngstown
  • slotface
  • Durango
  • kavyap
  • mdbf
  • GTA5RPClips
  • JUstTest
  • tacticalgear
  • normalnudes
  • tester
  • osvaldo12
  • everett
  • cubers
  • ethstaker
  • anitta
  • provamag3
  • Leos
  • cisconetworking
  • megavids
  • lostlight
  • All magazines