From dwheeler at dwheeler.com  Mon May  3 16:43:30 2021
From: dwheeler at dwheeler.com (David A. Wheeler)
Date: Mon, 3 May 2021 12:43:30 -0400
Subject: FYI: Diverse Double-Compiling DDC presentation now on Youtube
Message-ID: <9581FBE9-B832-4A4A-A0DB-D8188F0FB18A@dwheeler.com>

FYI, my original public defense presentation about "Diverse Double-Compiling? (DDC) is now on Youtube:
https://www.youtube.com/watch?v=QYH18NpsRu8

Here?s some quick context:
Reproducible builds, as discussed in this mailing list,
counters many build attacks by ensuring that the same tools produce the same resulting package.
But how do you know the tools are not subverted in *their* build processes?
Well, you can use reproducible builds on those tools as well. However,
compilers are a special case. Since compilers (and similar tools) compile themselves, they create a ?loop?
that?s harder to deal with. (In general, cycles create many problems in computer science.)
The attack was originally discussed in the Multics security evaluation of 1974,
and popularized by Ken Thompson?s discussion & demonstration of the attack as explained in his
1984 Turing Award presentation ?Reflections on Trusting Trust?.

A strong way to counter this ?trusting trust? attack is  "Diverse Double-Compiling? (DDC).
The video above is my PhD public defense that it works. More details available here:
https://dwheeler.com/trusting-trust/

Another countermeasure is to use bootstrappable builds (e.g., GNU Mes).
Bootstrappable builds & DDC aren?t really competitors, because
they can work well together to even-more-powerfully counter such attacks.

The recording is wiggly (it wasn?t professionally recorded), but it should be understandable.

Enjoy!

--- David A. Wheeler