1

I was wondering about how compilers like GCC compile themselves after each release but that got me thinking:
Are compilers safe?

Correct me if I'm wrong, but even if at one step along the way a version of the compiler was compiled with a piece of malicious code put inside, wouldn't any release after that be infected as well? This would cause a chain reaction and could potentially infect millions of devices.

Has this happened already? If so how did we find out? Is there any group or organization making sure this doesn't happen?

Improve this question
1

1 Answer 1

Reset to default
6

No.

Ken Thompson released a paper in 1984 called "Reflections on Trusting Trust", in which he explained that verifiable trust is impossible to achieve.

As you correctly claimed, you can never be sure about these things. You cannot be sure that the program you are using doesn't contain malicious code. You could analyze the source code, but how do you know that the compiler used to compile it doesn't insert malicious code? You could compile the compiler yourself, but how do you know that compiler doesn't contain malicious code?

You could write a simple bootstrap compiler with basic assembler instructions, but you would still need a program to write that to disk and then execute it. How do you know that program doesn't insert malicious code? You could reverse-engineer that program, but how do you know that your debugger or decompiler doesn't include malicious code?

It quickly turns into turtles all the way down. The bottom line is that you can't really verify it without any reasonable doubt. There will always be a "But what if...?" left. But so far, things seem to be working fine, I guess.

Improve this answer
6
  • It's scary to think some how unsafe we might be... then again things like this exist so no safety to begin with
    – Xosrov
    Nov 30, 2019 at 18:11
  • 1
    @Xosrov: "It's scary to think some how unsafe we might be..."* - It is also scary to think what could all happen to you in real life. Yet, most bad things which could happen do not happen. Humans also established mechanisms like direct and inferred trust and being suspect of unexpected behavior which help us to deal with such risks - and this is not so much different in the "cyber space".
    – Steffen Ullrich
    Nov 30, 2019 at 18:17
  • @Xosrov Then again, a cosmic ray could hit your ram and change the contents of it, so you can never be 100% safe if what you see is real anyways.
    – user163495
    Nov 30, 2019 at 18:44
  • It wouldn't be so scary if it was just some random thing that happens... Someone with access to this kind of thing could cause way more than imaginable, potentially destroying our trust in technology for years to come
    – Xosrov
    Nov 30, 2019 at 19:01
  • 1
    @Xosrov Because technology is inherently not trustworthy. But the things we should be scared about isn't software, because it's not likely that every text editor world wide is infected. But what we should worry about are our CPUs, because they are fucked beyond repair
    – user163495
    Nov 30, 2019 at 19:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .