0

I wrote a program. I want to publish a compiled executable for downloading by the public.

How can I compile and distribute it without contact with my (presumably insecure and infected) operating system? How do software vendors ensure that their software packages are malware-free?

The absence of relevant information on the web is pretty disturbing. It’s as if nobody in the world except me cared about safe and responsible distribution of software. Why are there no clean compilation services on the web? I’m not going to buy a separate computer only to compile and upload one little application.

  • 2
    how would a virus on your machine infect the compilation process? how would you be able to trust a 3rd party to compile for you? – schroeder Oct 21 '17 at 18:40
  • 1
    the simplest form is to compile on 2 different computers and check the hashes - if they match, then one machine has not tampered with it – schroeder Oct 21 '17 at 18:41
  • 1
    Well, the first thing that comes to mind is that the compiler will tell you how big the output file is. If it suddenly becomes bigger on the file system, then a highly unlikely virus has altered it. – schroeder Oct 21 '17 at 19:02
  • 2
    Then you are afraid of a virus 'bullet' that constantly scans your filesystem looking for binaries that it has not infected yet and infects them instantly. That just doesn't happen quietly and is not the common case. If you do have to deal with this level of threat, you have other bigger risks to deal with. – schroeder Oct 21 '17 at 19:08
  • 2
    and free for tiny applications - probably because of this there is no sustainable business model. Most developers will refrain from uploading their valuable complex private source code to such a service because this code has a big monetary value. And the ones with simpler and less-valuable code have no interest in paying for this service. – Steffen Ullrich Oct 21 '17 at 20:21
2

It's important to think about what kind of threat you are trying to protect against. Your questions could be taken to imply two different threat levels:

  1. A general virus that just injects itself into any executables it happends to stumble over.
  2. Malware designed specifically to infect your build process and embed itself in freashly compiled executables.

To protect yourself against the first category, schroeder has a good suggestion - just check the filesize. Your compiler probably already outputs that. Or have your compiler output a hash and use that, or sign the file in the build flow.

If you are up against a theat of the second type, the above is no good. If the attacker is sofisticated enought, nothing can help you at that point. As soon as your system is compromised, you are owned.

In the end, it comes down to how advanced threats you want to protect yourself against. Using a separate machine could help, and so could a VM (or a "trusted third party", even though I am not sure I would trust one). But a sufficiently advanced attacker could overcome those obstacles as well.

  • Yeah, I’m concerned about old-school malware (therefore type 1). Therefore @schroeder’s solution is good enough for my little app. However, I believe that a properly managed separate machine would be effective even against type 2 threat. Proof of concept: offline Bitcoin wallets. – 7vujy0f0hy Oct 21 '17 at 19:58
  • Maybe I was making it to simple by setting a binary scale. A well maintained separate machine would perhaps be safe against 1.5 threats. If it is worth the trouble depends on how likely you think such a threat is. – Anders Oct 21 '17 at 20:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.