Linked by Thom Holwerda on Sun 22nd Oct 2006 22:56 UTC
Thread beginning with comment 176371
To read all comments associated with this story, please click here.
To read all comments associated with this story, please click here.





Member since:
2005-07-10
Reflections on Trusting Trust
Ken Thompson
http://www.acm.org/classics/sep95/
It's not the "little" bugs. You're not thinking low-level enough.
Keep reading until you understand.
Excerpt:
"The moral is obvious. You can't trust code that you did not totally create yourself. (Especially code from companies that employ people like me.) No amount of source-level verification or scrutiny will protect you from using untrusted code. In demonstrating the possibility of this kind of attack, I picked on the C compiler. I could have picked on any program-handling program such as an assembler, a loader, or even hardware microcode. As the level of program gets lower, these bugs will be harder and harder to detect. A well installed microcode bug will be almost impossible to detect."
This is also instructive.
A Taste of Computer Security
Amit Singh
http://kernelthread.com/publications/security/
Yes, I know I'm harping ... :-)
Edited 2006-10-28 19:20