[Pharo-project] Trusting Trust
This is slightly paranoid thinking, but considering the long evolution of Smalltalk live images (apparently all the way from the original Xerox PARC ST80 [1] ) in relation to Ken Thompson's "Reflections on Trusting Trust" [2] - are there any mechanisms to prevent trojan code living undetected inside a Smalltalk compiler/decompiler ? Bruce Schneier [3] provides a shorter overview of [2] if that is not to your taste. To what degree might this ever be an issue with Pharo and how might it be mitigated ? cheers, -ben [1] http://lists.squeakfoundation.org/pipermail/squeak-dev/1999-January/011116.h... [2] http://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf [3] http://www.schneier.com/blog/archives/2006/01/countering_trus.html
On 7 February 2012 15:47, Ben Coman <btc@openinworld.com> wrote:
This is slightly paranoid thinking, but considering the long evolution of Smalltalk live images (apparently all the way from the original Xerox PARC ST80 [1] ) in relation to Ken Thompson's "Reflections on Trusting Trust" [2] - are there any mechanisms to prevent trojan code living undetected inside a Smalltalk  compiler/decompiler ?  Bruce Schneier [3] provides a shorter overview of [2] if that is not to your taste.
yes. Such mechanism is you :) Actually, you can ask same question to Lunix kernel, or any other open project with all source code available. And get same response. Trojans don't like the light, they usually lurking in closed-source environments. You can attempt to add a trojan, but since there is too many eyes, which will be looking what you done, even if you somehow succeed with integrating it into the system, it won't stay there for long for sure.
To what degree might this ever be an issue with Pharo and how might it be mitigated ?
cheers, -ben
[1] http://lists.squeakfoundation.org/pipermail/squeak-dev/1999-January/011116.h... [2] http://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf [3] http://www.schneier.com/blog/archives/2006/01/countering_trus.html
-- Best regards, Igor Stasenko.
On 02/07/2012 02:47 PM, Ben Coman wrote:
This is slightly paranoid thinking, but considering the long evolution of Smalltalk live images (apparently all the way from the original Xerox PARC ST80 [1] ) in relation to Ken Thompson's "Reflections on Trusting Trust" [2] - are there any mechanisms to prevent trojan code living undetected inside a Smalltalk compiler/decompiler ? Bruce Schneier [3] provides a shorter overview of [2] if that is not to your taste.
To what degree might this ever be an issue with Pharo and how might it be mitigated ?
I think it's worse in Pharo because you're never bootstrapping from source. From all you know the tools could be subverted to show you a different code than is actually running in the system. Cheers Philippe
On Feb 8, 2012, at 9:35 AM, Philippe Marschall wrote:
On 02/07/2012 02:47 PM, Ben Coman wrote:
This is slightly paranoid thinking, but considering the long evolution of Smalltalk live images (apparently all the way from the original Xerox PARC ST80 [1] ) in relation to Ken Thompson's "Reflections on Trusting Trust" [2] - are there any mechanisms to prevent trojan code living undetected inside a Smalltalk compiler/decompiler ? Bruce Schneier [3] provides a shorter overview of [2] if that is not to your taste.
To what degree might this ever be an issue with Pharo and how might it be mitigated ?
I think it's worse in Pharo because you're never bootstrapping from source. From all you know the tools could be subverted to show you a different code than is actually running in the system.
well I do not think so since we can all read the code. If you have a bootstrap in C or assembly it does make me more confident. So the argument while nice at first sight does not hold a second. Now we will get a bootstrapped version of pharo believe me :)
Cheers Philippe
On 02/08/2012 10:33 AM, Stéphane Ducasse wrote:
On Feb 8, 2012, at 9:35 AM, Philippe Marschall wrote:
On 02/07/2012 02:47 PM, Ben Coman wrote:
This is slightly paranoid thinking, but considering the long evolution of Smalltalk live images (apparently all the way from the original Xerox PARC ST80 [1] ) in relation to Ken Thompson's "Reflections on Trusting Trust" [2] - are there any mechanisms to prevent trojan code living undetected inside a Smalltalk compiler/decompiler ? Bruce Schneier [3] provides a shorter overview of [2] if that is not to your taste.
To what degree might this ever be an issue with Pharo and how might it be mitigated ?
I think it's worse in Pharo because you're never bootstrapping from source. From all you know the tools could be subverted to show you a different code than is actually running in the system.
well I do not think so since we can all read the code.
No, read the argument again. If the compiler is compromised and the other tools in the image are compromised you can't read the code because the tools don't display you the actual code. Cheers Philippe
participants (4)
-
Ben Coman -
Igor Stasenko -
Philippe Marschall -
Stéphane Ducasse