On Tue, Jul 05, 2016 at 07:24:38PM +0200, Quentin Rameau wrote:
> > So let's consider 3 situations.
> > 1-- Compile scc with gcc. Use the output binary to compile scc. Get B1
> > 2-- Compile scc with tcc. Use the output binary to compile scc. Get B2
> > 3-- Compile scc with clang. Use the output binary to compile scc. Get
> > B3
> >
> > Are you saying that if we compare the md5 of B1, B2 and B3 they will
> > be identical?
> Well, that could depend on how high are solar winds that day (apart
> from that, they should be, yes).
Try it out: you are mistaken here. Just use a simple hello world and you
will see that at least gcc and clang don't generate the same binary (if
compared with some kind of bindiff you'll see that they are not even
close) - I just tried it myself.
But compiling a compiler with different compilers and compare the
binaries each version generates is a way to make sure that no (possibly)
malicous) function is injected (see [1] - a paper about a way to counter
the attack desribed in "Reflections on Trusting Trust" which itself is a
good read, too).
WKR
Hinnerk
[1]
https://www.acsa-admin.org/2005/abstracts/47.html
Received on Tue Jul 05 2016 - 20:11:51 CEST