Who Controls Your Computer? (And How to Make Sure It’s You)
March 7th, 2017Good luck with that.
My paranoia doesn’t even begin to scratch the surface of this thing. Keep going, keep pushing through, and the next thing you know, you’re falling through fractals of fuckedness that endlessly reveal more fuckedness the deeper you descend.
Via: François-René Rideau:
At least in theory, we therefore know how to build ourselves small paradises of trusted code. Unhappily, we also know that even if you can trust all the source code on the system, you still cannot blindly trust the system — because as Gödel once established, the source code is not and can never be all the code. Your code always relies on semantic foundations to tell what the code means; and even if you manage to formalize these foundations, you’ll find they in turn rely on further meta-foundations, to which there is no end. It’s Turtles All The Way Down.
Indeed, Ken Thompson, in his Turing Award lecture, Reflections on Trusting Trust, famously demonstrated how, by subverting the compiler, he could introduce a security backdoor in the login program despite its source code being correct; furthermore, the compiler modification that introduced this security backdoor would also reproduce itself when you recompiled the compiler, even when compiling the compiler from unmodified source code. Therefore, after initially bootstrapping this attack, there was no malicious source code left in the system to distinguish a safe system from a subverted system, yet a subverted system would remain backdoored forever (well, until someone manages to subvert the subversion).
