Post B4jkVbmjrefpm5vSNs by brettm@swarm.coiloptic.org
 (DIR) More posts by brettm@swarm.coiloptic.org
 (DIR) Post #B4jj2lSSio1DQH7jrU by brettm@swarm.coiloptic.org
       0 likes, 0 repeats
       
       "The moral is obvious. You can't trust code that you did not totally create yourself. (Espcially code from companies that employ people like me.) No amount of source-level verification or scrutiny will protect you"Ken Thompson
       
 (DIR) Post #B4jkVbmjrefpm5vSNs by brettm@swarm.coiloptic.org
       0 likes, 0 repeats
       
       very true! (spoken from the tiny gap in my cupboard door)
       
 (DIR) Post #B4jmb2QuPoWhmIQq0W by penny@eldritch.cafe
       0 likes, 0 repeats
       
       @brettm note the report Fully Countering Trusting Trust through Diverse Double-Compiling https://arxiv.org/abs/1004.5534
       
 (DIR) Post #B4jmb2aTqEBOFyuTvU by brettm@swarm.coiloptic.org
       0 likes, 0 repeats
       
       This is not feasable for a large compiler like GCC or LLVM though. Apart from the gigantic effort required to write a compiler that can compile those giant beasts, it then has to generate exact replica code as the other compiler. Completely impossible. You could probably use this technique for TCC or QBE or something minimal like that tho.