Really? [LWN.net]

Really?

Posted May 7, 2021 21:56 UTC (Fri) by corbet (editor, #1)
In reply to: Rethinking Fedora's compiler policy by SomeOtherGuy
Parent article: Rethinking Fedora's compiler policy

What, exactly, would be the point of a comment like this?

It's not hard to understand the concerns around proprietary hosting operations like GitHub; I suspect the person you are replying to understands them rather better than you (or I) do. But there is a lot of useful code hosted on GitHub. What is the value in heckling somebody trying to point to some of this code? Please don't do that here.

Really?

Posted May 8, 2021 1:38 UTC (Sat) by SomeOtherGuy (guest, #151918) [Link]

I also offer you this corollary:

(Assuming the projects are relevant and could help Python:)

IF they were dependable and great projects THEN the Python lot would surely use them and give that crypto library to the masses

The contrapositive (logically equiv)

IF the Python lot are not using those THEN they are not dependable and great projects

A little inaccuracy saves a lot of explanation, but you get the idea

Really?

Posted May 8, 2021 1:59 UTC (Sat) by SomeOtherGuy (guest, #151918) [Link] (2 responses)

At the risk of earning the ire of #1 there, I proffer one more thing

Ancient paper by Denis Ritchie I believe (one of them) an essay on trusting trust, in it he builds a toolchain which is able to hide a back door (or some such) into the compiler, that passes itself on to new compilers and is invisible (as they are also adjusted) by nm, and whatever the old version of objdump and friends are

If we were allowing Rust into our computers I would expect no less caution from the Python developers especially on cryptography.

I hope this makes my case of why my sarcastic "oh a github link" comment was justified - we should not use that as a credential

Reference to "Trusting Trust" (WAS: Really?)

Posted May 9, 2021 1:56 UTC (Sun) by josephrjustice (guest, #26250) [Link] (1 responses)

Ken Thompson.

"Reflections on Trusting Trust", his lecture when he was presented with the Turing Award.

Here's a link to an electronic version of the written copy of the lecture: https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_... . If one doubts that the electronic copy is an accurate reproduction, I expect that printed copies of the original academic journal it was published in can be found at most reputable academic libraries (at least in English-speaking countries).

This link was the first hit when I just now did a Google search on the phrase "trusting trust" (not including the quotes).

You're welcome.

Reference to "Trusting Trust" (WAS: Really?)

Posted May 10, 2021 22:29 UTC (Mon) by SomeOtherGuy (guest, #151918) [Link]

That was it - TBH I figured we'd all heard about it - so yeah pulling compiler stuff from github seems less wise than "try this wordpress plugin"

Honestly the thing that surprised me was how easy it was for the thing to pass itself off in future compilers, that spooked me a bit, I figured "sure yeah do that" - but to have it insert itself into compilers it builds (with decent accuracy, I imagine it can be defeated) is still REALLY impressive

I'd never question objdump -D

Really?

Posted May 8, 2021 3:07 UTC (Sat) by SomeOtherGuy (guest, #151918) [Link]

Sorry for the quad post, a comment that seems to be empty (808) has showed up with "P" status, I replied to it trying to figure out what it was (asking for help and mentioning I checked the FAQ/RTFM) and I cannot see those on the article, but they have "A" status?

https://lwn.net/Articles/855810/

Like this

I just want to make sure I've not done anything wrong (with the system) but the stuff of substance appears. So nothing is lost anway