The German government paid $500,000+, to Arch Linux, to re-write Arch Package Management in Rust. Is Germany hoping to inject backdoors, or other spyware, in...
Haha yeah it’s not great. Now that I thought about it some more, I wonder if you could use decompiling to verify that the compiler is doing what it says it does. If you compile a minimal program, and then decompile the assembly, you could see if there are any instructions that shouldn’t be there. It wouldn’t be trivial, but seems like it is a possible way to check that the compiler isn’t injecting something weird.
The compiler can introduce vulnerabilities only on some specific instructions, although it makes it difficult to propagate it further to new compilers.
Thanks for the explanation. I don’t like this. Lmao.
Haha yeah it’s not great. Now that I thought about it some more, I wonder if you could use decompiling to verify that the compiler is doing what it says it does. If you compile a minimal program, and then decompile the assembly, you could see if there are any instructions that shouldn’t be there. It wouldn’t be trivial, but seems like it is a possible way to check that the compiler isn’t injecting something weird.
The compiler can introduce vulnerabilities only on some specific instructions, although it makes it difficult to propagate it further to new compilers.
Good point, verifying a disassembled binary wouldn’t exhaustively prove the compiler is safe.