On 7 February 2012 15:47, Ben Coman <btc@openinworld.com> wrote:
This is slightly paranoid thinking, but considering the long evolution of Smalltalk live images (apparently all the way from the original Xerox PARC ST80 [1] ) in relation to Ken Thompson's "Reflections on Trusting Trust" [2] - are there any mechanisms to prevent trojan code living undetected inside a Smalltalk  compiler/decompiler ?  Bruce Schneier [3] provides a shorter overview of [2] if that is not to your taste.
yes. Such mechanism is you :) Actually, you can ask same question to Lunix kernel, or any other open project with all source code available. And get same response. Trojans don't like the light, they usually lurking in closed-source environments. You can attempt to add a trojan, but since there is too many eyes, which will be looking what you done, even if you somehow succeed with integrating it into the system, it won't stay there for long for sure.
To what degree might this ever be an issue with Pharo and how might it be mitigated ?
cheers, -ben
[1] http://lists.squeakfoundation.org/pipermail/squeak-dev/1999-January/011116.h... [2] http://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf [3] http://www.schneier.com/blog/archives/2006/01/countering_trus.html
-- Best regards, Igor Stasenko.