Fully Countering Trusting Trust through Diverse Double-Compiling · HackerPapers discussions

Fully Countering Trusting Trust through Diverse Double-Compiling — mentioned by laurenth

Fri, 03 Apr 2026 13:33:16 GMT

A shell is almost always used to setup the bootstrap environment, so the dependency on a shell is more or less always there. Otherwise, something special with POSIX shell is its large number of independent implementations, making it the ideal starting point for diverse double-compilation (https://arxiv.org/abs/1004.5534). The idea is to bootstrap a toolchain from multiple compilers (shells in this case), and the result compared to verify that no shell introduced a trusting trust attack.

Paper and discussion history. A mention is not an endorsement.

Fully Countering Trusting Trust through Diverse Double-Compiling — mentioned by vlovich123

Tue, 24 Mar 2026 14:09:12 GMT

Reflect in what way? The primary focus of that talk is that it’s possible to infect the binary of a compiler in a way that source analysis won’t reveal and the binary self replicates the vulnerability into other binaries it generates. Thankfully that particular problem was “solved” a while back [1] even if not yet implemented widely. However, the broader idea of supply chain attacks remains challenging and AI doesn’t really matter in terms of how you should treat it. For example, the xz-utils back door in the build system to attack OpenSSH on many popular distros that patched it to depend on…

Paper and discussion history. A mention is not an endorsement.

Fully Countering Trusting Trust through Diverse Double-Compiling — HN submission

Sat, 30 Mar 2024 14:56:50 GMT

Fully countering trusting trust through diverse double-compiling (2005)

9 points; 1 discussion reply on HN. Paper and source history. A submission is not an endorsement.

Fully Countering Trusting Trust through Diverse Double-Compiling — mentioned by dllthomas

Fri, 01 Dec 2017 17:10:43 GMT

See David Wheeler's work on "Diverse Double Compiling". What the parent describes seems to be similar. https://arxiv.org/abs/1004.5534

Paper and discussion history. A mention is not an endorsement.