19 Sep
2021
19 Sep
'21
3:46 p.m.
This is FYI. No comment on whether it was a good idea or not. :-)
Arnold
From: Niklas Rosencrantz <niklasro(a)gmail.com>
Date: Sun, 19 Sep 2021 17:10:24 +0200
To: tinycc-devel(a)nongnu.org
Subject: Re: [Tinycc-devel] Can tcc compile itself with Apple M1?
Hello!
For demonstration purpose I put my experiment with a compiler backdoor in a
public repository
https://github.com/montao/ddc-tinyc/blob/857d927363e9c9aaa713bb20adbe99ded7…
It's part of my academic project to work on provable compiler security.
I tried to do it according to the "Reflections on Trusting Trust" by Ken
Thompson, not only to show a compiler Trojan horse but also to prove that
we can discover it.
What it does is inject arbitrary code to the next version of the compiler
and so on.
Regards \n
19 Sep
19 Sep
3:58 p.m.
> For demonstration purpose I put my experiment with
a compiler backdoor in a
> public repository
> It's part of my academic project to work on
provable compiler security.
Sounds like excellent grounds for expulsion.
Whatever happened to the people who were submitting poison pull requests at U-Minnesota?
4:02 p.m.
Al Kossow <aek(a)bitsavers.org> wrote:
Supposedly he's able to show that the compiler has been hacked.
> For
demonstration purpose I put my experiment with a compiler backdoor in a
> public repository
> It's part of my academic project to work
on provable compiler security.
Sounds like excellent grounds for expulsion.
Whatever happened to the people who were submitting poison pull requests at U-Minnesota?
4:10 p.m.
-------- Original Message --------
On Sep 19, 2021, 8:58 AM, Al Kossow < aek(a)bitsavers.org> wrote:
> For demonstration purpose I put my experiment with
a compiler backdoor in a
> public repository
> It's part of my academic project to work on provable compiler security.
Sounds like excellent grounds for expulsion.
Whatever happened to the people who were submitting poison pull requests at U-Minnesota?
It's in his own fork, in a directory called tcc-evil. He's not exactly sneaking
it into the distribution. Calling it expulsion-worthy reminds me of the time a guy phoned
the FBI because of an article he read in the NYT: Sandia Labs was running botnets in a
virtualized environment! (Could the cluster route to the Internet? No, but he didn't
know that, and he didn't care; only bad people have botnets)
john
960
days inactive
960
days old
3 comments
3 participants
participants (3)
-
Al Kossow -
arnold＠skeeve.com -
John Floren