Slashdot article on MITRE open source software

[jabr at abreau.net (John Abreau)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Content-Type: text/plain; charset=us-ascii

John Chambers <jc at trillian.mit.edu> writes:

> Then, of  course,  there's  Ken  Thompson's  famous  "Reflections  on
> Trusting Trust" paper, in which he explains how to install a backdoor
> in a program in such a way that it doesn't  appear  anywhere  in  the
> source,  but  is  inserted  in the binary by the compiler.  Also, the
> insertion code doesn't appear in the compiler source, but is  in  the
> binary version of the compiler, even after you recompile it.

I remember reading that paper back in college. I responded at the time 
that if you write your own bootstrap compiler to compile the "real" 
compiler's source, you'll then have a binary of the "real" compiler 
that doesn't contain the insertion code. 

Today I would add to the rebuttal an assertion that the premise assumes 
a bug-free instance of the insertion code, and one that can successfully 
anticipate any future enhancements and other modifications to the compiler 
source code. I'd even speculate that such an ability might require an 
AI of nearly human-level intelligence, and I doubt such a thing would be 
small enough to insert unnoticed into the newly compiled compiler binary. 


- --
John Abreau / Executive Director, Boston Linux & Unix
Email jabr at blu.org / WWW http://www.abreau.net / PGP-Key-ID 0xD5C7B5D9
PGP-Key-Fingerprint 72 FB 39 4F 3C 3B D6 5B E0 C8 5A 6E F1 2C BE 99


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iQCVAwUBPefRy1V9A5rVx7XZAQIDYAP/SxUlMc+/GHf7idFUMKo5wNPy1vrwhe8F
MZN99FKXVUjYR+R5Io/BQb9WOEScBRjwgBa5dL/+fyN21vGBlYs/Yj+GF7fbRjpv
fqHIyZxswLvxZ30peHkRvD874Qul6A59J0s+lPBymAFxT8lLC0oYkmXvmBqgXli0
XoLTpDWDXX8=
=31wk
-----END PGP SIGNATURE-----