INTL 3:770/1 3:770/3
REPLYADDR steveo@eircom.net
REPLYTO 3:770/3.0 UUCP
MSGID: <20240211051708.63ca635b12fc46989aac4a41@eircom.net> 743b94f0
REPLY: ff227503
PID: SoupGate-Win32 v1.05
On Sat, 10 Feb 2024 23:13:20 +0100
Björn Lundin wrote:
> On 2024-02-10 20:12, Ahem A Rivet's Shot wrote:
> > On Sat, 10 Feb 2024 19:37:04 +0100
> > Björn Lundin wrote:
> >
> >> Of course not - but I was referring to that if you don't trust the
> >> binaries from your distribution, then you'd need to check ALL source
> >> code. Not only wget/curl - but everything from kernel all the way to
> >> web browsers
> >
> > Do all that and you are *still* open to Ken Thompson's attack
> > via a poisoned compiler.
> >
>
> Well, verifying gcc sources could be included in the above - 'between
> kernel and web browser'. At least if you are installing compilers
The point of Ken Thomson's attack is that you have to compile those
gcc sources and that compiler can poison the binary you produce from the
clean gcc sources. So inspecting sources doesn't help you.
--
Steve O'Hara-Smith
Odds and Ends at http://www.sohara.org/
For forms of government let fools contest
Whate're is best administered is best - Alexander Pope
--- SoupGate-Win32 v1.05
* Origin: Agency HUB, Dunedin - New Zealand | Fido<>Usenet Gateway (3:770/3)
SEEN-BY: 10/0 1 15/0 90/1 103/705 105/81 106/201 128/260 129/305 135/225
SEEN-BY: 153/757 7715 218/0 1 601 700 840 870 930 220/70 221/1 6 226/17
SEEN-BY: 226/30 100 227/114 229/110 112 113 200 206 307 317 400 426
SEEN-BY: 229/428 470 550 616 664 700 240/1120 266/512 267/800 282/1038
SEEN-BY: 291/111 292/854 301/1 113 812 310/31 320/219 322/757 335/364
SEEN-BY: 341/66 342/200 396/45 460/58 633/280 712/848 770/1 3 100
SEEN-BY: 770/330 340 772/210 220 230 5020/400 1042 5058/104 5075/35
PATH: 770/3 1 218/840 221/6 301/1 218/700 229/426
|
