Path: csiph.com!usenet.pasdenom.info!gegeweb.org!aioe.org!news.stack.nl!newsfeed.xs4all.nl!newsfeed2.news.xs4all.nl!xs4all!newsgate.cistron.nl!newsgate.news.xs4all.nl!post.news.xs4all.nl!not-for-mail
Date: Mon, 09 Sep 2013 06:02:18 -0500
From: Anthony Papillion <papillion@gmail.com>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130804 Thunderbird/17.0.8
MIME-Version: 1.0
To: python-list@python.org
Subject: Re: Can I trust downloading Python?
References: <CAOO2PexT3XagV4u7ScDiZgifZjzapt9cem9W+3Bag1CBrsnMpA@mail.gmail.com> <mailman.150.1378609508.5461.python-list@python.org> <522c6e4e$0$29988$c3e8da3$5496439d@news.astraweb.com> <XsSdnZfDdPBCPbHPnZ2dnUVZ_vidnZ2d@earthlink.com> <mailman.156.1378658357.5461.python-list@python.org> <522d97e1$0$29893$c3e8da3$5496439d@news.astraweb.com>
In-Reply-To: <522d97e1$0$29893$c3e8da3$5496439d@news.astraweb.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: list
Newsgroups: comp.lang.python
Message-ID: <mailman.171.1378724549.5461.python-list@python.org>
Lines: 43
NNTP-Posting-Host: 2001:888:2000:d::a6
Xref: csiph.com comp.lang.python:53862

On 09/09/2013 04:41 AM, Steven D'Aprano wrote:
> On Mon, 09 Sep 2013 02:39:09 +1000, Chris Angelico wrote:
> 
>> On Mon, Sep 9, 2013 at 2:08 AM, Charles Hottel <chottel@earthlink.net>
>> wrote:
>>> I think this article is relevant althought the code examples are not
>>> Python but C:
>>>
>>> http://cm.bell-labs.com/who/ken/trust.html
>>
>> That is quite true, and yet not truly helpful here :) It's like pointing
>> out that we could be being fed false information, and then suggesting
>> that The Matrix is technically possible. Once you start distrusting to
>> that level, you become paranoid to a point that's inappropriate to all
>> but the most critical situations. I'd accept and maybe even recommend
>> that sort of paranoia if you're running a nuclear power station, or an
>> automated weapon system capable of firing missiles that destroy the
>> planet, or a bank that holds everyone's money. For the average Joe,
>> there's no point panicking.
>>
>> Also: That hack works beautifully when there's precisely one C compiler.
>> In today's world, there are many (well known ones like gcc, clang, MS
>> Visual Studio (whatever the compiler from that is called), and a bunch
>> of lesser-known ones as well), and it's pretty easy to just grab a
>> different compiler and build. The chances that your code will be falsely
>> compiled by TWO compilers would have to be infinitesimal, and you
>> needn't stop at two. 
> 
> That logic is dubious. Compilers aren't compromised by chance, and we 
> don't know the a priori probability of any specific compiler being 
> compromised. That depends on the attacker, surely? We know, for example, 
> that the NSA has compromised multiple brands of router, smart phone and 
> similar. If they, or some other similar organisation with equivalent 
> capabilities, were going to attack compilers in the same manner, they 
> surely wouldn't stop at one.

But (and this is stepping into *really* paranoid territory here. But
maybe not beyond the realm of possibility) it would not be so hard to
compromise compilers at the chip level. If the NSA were to strike an
agreement with, say, Intel so that every time a compiler ran on the
system, secret code was discreetly inserted into the binary, it would be
nearly impossible to detect and a very elegant solution to a tough problem.