[Discuss] our friend the nsa

[dsr at randomstring.org (Dan Ritter)]

On Thu, Sep 19, 2013 at 01:26:45PM -0400, Richard Pieri wrote:
> Dan Ritter wrote:
> >That is, can someone use the same toolchain Apple uses to
> >compile the same source and get the same binaries?
> >
> >And if so, has anyone done so?
> 
> Yes. It's called PureDarwin:
> http://www.puredarwin.org/


No, that proves that the source compiles legitimately. I want to
know if anyone has run diffs against the binaries that Apple
provides and the binaries generated from the Apple source to
determine whether Apple is actually using that source as-is.

Reflections on Trusting Trust, of course, but also the much
simpler "separate version for source code release removes our
special sauce".

-dsr-