Анализ страницы https://dwheeler.com/trusting-trust
Основное Готовность: 100%
Домен
dwheeler.com
Состояние доменного имени
?
Проверяем корректность доменного имени и наличие технических проблем на уровне домена.
Домен второго уровня идеален для продвижения.
Отличный запоминающийся домен.
Ответ сервера
200 Успешный ответ
HTTP-код ответа и цепочка редиректов
?
Код 200 — страница доступна. Коды 3xx — редиректы (цепочки замедляют загрузку и размывают ссылочный вес). Коды 4xx/5xx — ошибки, поисковик не сможет проиндексировать страницу.
Сервер настроен корректно.
Цепочка редиректов:
https://dwheeler.com/trusting-trust
301 MovedPermanently
https://dwheeler.com/trusting-trust/
200 OK
Безопасность
Сайт безопасен
Использование HTTPS и SSL-сертификат
?
HTTPS — обязательный стандарт. Google и Яндекс отдают предпочтение защищённым сайтам. Отсутствие SSL или просроченный сертификат ведут к предупреждениям в браузере и снижению позиций.
Не настроен HSTS (Strict-Transport-Security) — рекомендуется включить.
На сайте работает защищенный протокол ssl и сайт открывается по https.
Ssl-сертификат действителен до 10.11.2026 2:59:59.
Поздравляем! Сайт не содержится в реестре РКН.
Кодировка
utf-8
Кодировка символов страницы
?
Стандарт — UTF-8. Неправильная кодировка вызывает нечитаемые символы и мешает поисковику корректно распознать текст страницы.
Указана кодировка на странице utf-8.
Язык
Атрибут lang в HTML-теге
?
Атрибут lang (<html lang="ru">) сообщает поисковикам и браузерам, на каком языке написана страница. Помогает при ранжировании в региональном поиске.
Язык страницы не указан. Рекомендуется явно указать язык документа!
Скорость загрузки
~0,48сек
Время отклика сервера (TTFB)
?
Time To First Byte — время до получения первого байта от сервера. Норма до 200 мс. Медленный отклик ухудшает пользовательский опыт и ранжирование: Яндекс и Google учитывают скорость страниц.
Скорость загрузки сайта 0,48сек оптимальна.
Объем документа
126Кб
Размер HTML-кода страницы
?
Слишком большой HTML замедляет парсинг браузером и сканирование поисковым роботом. Рекомендуется не более 200 Кб.
Объем html-документа 126Кб оптимален.
Структура html-документа корректна.
Ресурсы
Ресурсы: 0
Внешние ресурсы страницы (CSS, JS, изображения)
?
Количество и тип подключённых ресурсов влияют на скорость загрузки. Большое число запросов увеличивает время рендеринга страницы.
Ресурсы не найдены. Неужели ваш сайт на чистом html?
Серверные заголовки
Кол-во: 17
HTTP-заголовки ответа сервера
?
Заголовки сервера передают браузеру и поисковику служебную информацию: кеширование, безопасность (CSP, HSTS), сжатие (gzip). Правильная настройка ускоряет загрузку и повышает защищённость.
Найдены серверные заголовки 17шт. Подробнее про серверные заголовки.
Показать полный список серверных заголовков
| Ключ | Значение |
|---|---|
| Server | GitHub.com |
| Access-Control-Allow-Origin | * |
| ETag | "6a877441-1fbef" |
| Cache-Control | max-age=600 |
| x-proxy-cache | MISS |
| x-github-request-id | 5CFC:9229B:3BF481:40CB0F:6A8A7DDE |
| x-github-edge-region | swedencentral |
| Accept-Ranges | bytes |
| Age | 0 |
| Date | Sun, 23 Aug 2026 04:58:06 GMT |
| Via | 1.1 varnish |
| X-Served-By | cache-bma-essb1270046-BMA |
| X-Cache | MISS |
| x-cache-hits | 0 |
| x-timer | S1787461086.365205,VS0,VE125 |
| Vary | Accept-Encoding |
| x-fastly-request-id | 967e53a83c375861f239a1938af456c5a02bcbe0 |
CMS
WordPress
Система управления сайтом (движок)
?
CMS — это движок, на котором работает сайт (WordPress, 1C-Bitrix, Tilda и др.). Знание CMS помогает понять возможности SEO-оптимизации и подобрать подходящие инструменты. «Не определена» — вероятно, самописный сайт или нестандартная сборка.
Сайт работает на CMS WordPress.
Веб-сервер
GitHub.com
Программное обеспечение сервера
?
Веб-сервер — это ПО, которое отдаёт страницы посетителям (nginx, Apache, IIS, LiteSpeed и др.). Определяется по серверным заголовкам ответа (Server, X-Powered-By и т.п.). «Не определён» — сервер намеренно скрывает эти заголовки, это нормальная практика безопасности.
В заголовке Server указано: GitHub.com.
Мета-теги Готовность: 24%
Title
Fully Countering Trusting Trust through Diverse Double-Compiling (DDC) - Countering Trojan Horse attacks on Compilers
Заголовок страницы в браузере и поисковой выдаче
?
Title — главный SEO-заголовок страницы. Влияет на CTR в поиске и ранжирование. Оптимальная длина: 50–70 символов. Ключевые слова — ближе к началу.
Устраните дубли в title: countering(2)
Необходимо уменьшить число символов в title (текущее значение: 117, оптимально: от 40 до 45)
Description
David A. Wheeler's Page on Countering 'Trusting Trust' through Diverse Double-Compiling (DDC) - Countering Trojan Horse attacks on Compilers
Описание страницы в поисковой выдаче (сниппет)
?
Meta Description — текст под заголовком в выдаче. Напрямую на позиции не влияет, но влияет на CTR. Оптимальная длина: 120–160 символов.
Необходимо уменьшить число символов в description (текущее значение: 140, оптимально: от 120 до 130)
Keywords
Trusting trust, trojan horse, compiler, compilers, compilation, subversion, malicious, malicious compiler, subverted compiler, Thompson, Ken Thompson, ACSAC, ACSAC 2005, diverse double-compiling, diverse double compiling, DDC, Reflections on Trusting Trust, reproducible builds, reproduceable builds, deterministic builds, Spencer, Karger, Schell, Draper, McDermott, Unix, C compiler, tcc, gcc, David, Wheeler, David A. Wheeler, micro-taint, microtaint, micro-tainting, microtainting, Perl, regular expressions
Список ключевых слов страницы (устаревший тег)
?
Meta Keywords не учитывается Яндексом и Google для ранжирования с 2009–2012 годов. Заполнение не обязательно, но не вредит. Конкурент может использовать содержимое для анализа.
Keywords установлены.
Канонический Url
Указывает поисковику основную версию страницы
?
Canonical (rel=canonical) предотвращает проблему дублей страниц. Должен точно совпадать с URL проверяемой страницы. Неправильный canonical может передать ссылочный вес на другую страницу.
Рекомендуем прописать канонический Url.
Robots
Ошибок нет
Директивы для поисковых роботов на уровне страницы
?
Meta Robots управляет индексацией конкретной страницы: index/noindex — индексировать ли, follow/nofollow — следовать ли по ссылкам. Noindex полностью исключает страницу из поиска.
Meta-тег robots не указан. Страница свободна для индексации.
Адаптивность
width=device-width, initial-scale=1.0
Настройка масштабирования на мобильных устройствах
?
Тег viewport (<meta name="viewport">) сообщает браузеру, как масштабировать страницу на мобильных. Стандарт: width=device-width, initial-scale=1. Отсутствие — признак отсутствия мобильной версии.
Meta-тег viewport со значением-константой width=device-width задаёт ширину страницы в соответствии с размером экрана.
Meta-тег viewport со значением initial-scale=1.0 определяет масштаб 1:1, т.е. «не масштабировать».
Разметка OpenGraph
Не найдено
Мета-теги для красивых превью в соцсетях
?
OpenGraph (og:title, og:description, og:image) управляет тем, как страница выглядит при репосте в социальных сетях и мессенджерах. Отсутствие OG-тегов — невзрачный превью при шеринге.
Разметка OpenGraph не задана. Страница не оптимизирована под социальные сети. Мета-теги с разметкой Og помогают социальным роботам лучше структурировать Ваш сайт.
Все мета-теги
Кол-во: 3
Полный список мета-тегов страницы
?
Таблица всех meta-тегов, включая нестандартные. Позволяет найти опечатки, дубли и лишние теги.
Найдены мета-теги 3шт. Мета-теги не видимы для человека и предназначены для обмена информацией между веб-страницей и поисковыми системами, браузерами и другими веб-службами. С ними роботы 🤖 и устройства ведут себя более ожидаемо.
Показать полный список мета-тегов
| Тип | Название | Значение |
|---|---|---|
| name | viewport | width=device-width, initial-scale=1.0 |
| name | description | David A. Wheeler's Page on Countering 'Trusting Trust' through Diverse Double-Compiling (DDC) - Countering Trojan Horse attacks on Compilers |
| name | keywords | Trusting trust, trojan horse, compiler, compilers, compilation, subversion, malicious, malicious compiler, subverted compiler, Thompson, Ken Thompson, ACSAC, ACSAC 2005, diverse double-compiling, diverse double compiling, DDC, Reflections on Trusting Trust, reproducible builds, reproduceable builds, deterministic builds, Spencer, Karger, Schell, Draper, McDermott, Unix, C compiler, tcc, gcc, David, Wheeler, David A. Wheeler, micro-taint, microtaint, micro-tainting, microtainting, Perl, regular expressions |
Оптимизация Готовность: 80%
Структура
Ошибок нет
Семантические HTML-элементы страницы
?
Проверяет наличие основных структурных элементов: nav, header, footer, main. Корректная семантическая структура помогает поисковику понять архитектуру страницы.
Структура документа корректна (теги <html> и <body> присутствуют по одному на документ).
Контент
Ошибок нет
Объём и качество текстового содержимого
?
Анализирует объём полезного текста на странице. Слишком мало — страница может считаться малополезной. Слишком много — ухудшается читаемость и восприятие.
Слова из title 13 встречаются в тексте достаточно.
Абзацев с текстом 203 достаточно.
Среднее число слов в абзаце 86 достаточно.
Кол-во знаков контента 103464 на странице оптимально.
Кол-во слов 16586 на странице оптимально.
Заголовки
Ошибок нет
Иерархия заголовков H1–H6
?
H1 должен быть один и содержать ключевой запрос. H2–H6 описывают подразделы. Пропуск уровней (H1 → H3) и несколько H1 — типичные ошибки, снижающие понятность страницы для поисковика.
На странице присутствуют заголовки <h1> 18. Это прекрасно.
На странице присутствуют заголовки <h2> 17. Это хорошо.
Тошнота
12,04
Насколько одно слово доминирует в тексте
?
Классическая тошнота = √(частота самого повторяющегося слова). Норма до 7–8: текст воспринимается естественно. Выше — поисковик может счесть страницу переспамленной.
Тошнота превышает норму 5. Измените текст страницы!
Академич. тошнота
56,34%
Насколько текст перенасыщен ключевыми словами
?
Академическая тошнота = (частота слова / общее количество слов) × 100%. Показывает долю конкретного слова в тексте. Норма 5–15%.
Академическая тошнота превышает норму 5-15%. Измените текст страницы!
Семантическое ядро
20
Наиболее часто встречающиеся слова на странице
?
Топ слов по частоте использования. Показывает, какие слова доминируют в тексте с точки зрения поисковика.
Контент страницы содержит осмысленный текст и слова.
Показать список слов
| Слово | Кол-во | Частота |
|---|---|---|
| compiler | 145 | 0,87% |
| source | 75 | 0,45% |
| software | 62 | 0,37% |
| attack | 58 | 0,35% |
| reproducible | 48 | 0,29% |
| builds | 48 | 0,29% |
| compilers | 47 | 0,28% |
| hardware | 47 | 0,28% |
| dissertation | 42 | 0,25% |
| problem | 40 | 0,24% |
| different | 39 | 0,24% |
| trusted | 35 | 0,21% |
| trusting | 34 | 0,20% |
| process | 30 | 0,18% |
| information | 27 | 0,16% |
| malicious | 25 | 0,15% |
| example | 24 | 0,14% |
| should | 22 | 0,13% |
| binary | 22 | 0,13% |
| diverse | 21 | 0,13% |
Индексация Готовность: 0%
Индексирование
Есть ошибки
Разрешено ли индексирование страницы
?
Проверяет, не закрыта ли страница от индексации через robots.txt, meta robots или X-Robots-Tag. Страница, закрытая от индексации, не появится в поисковой выдаче.
Анкоров на странице 263 слишком много. Проведите ревизию и оптимизацию ссылок сайта.
Robots.txt
Не найден
Файл управления сканированием сайта роботами
?
Robots.txt указывает поисковым роботам, какие страницы сканировать, а какие — нет. Ошибки в файле могут случайно закрыть важные разделы от индексации.
Файл robots.txt не найден (ошибка 404). Крайне рекомендуем добавить файл robots.txt, это правило хорошего тона для поисковых роботов.
Sitemap
Кол-во: 0
XML-карта сайта для поисковиков
?
Sitemap.xml помогает поисковику быстрее находить и индексировать страницы. Особенно важен для крупных сайтов и новых страниц, на которые ещё нет входящих ссылок.
Robots.txt не содержит ссылку на карту сайта. Рекомендуется добавить карту сайта и указать ссылку на нее в robots.txt.
Внутренние ссылки
Кол-во: 37
Ссылки на другие страницы своего сайта
?
Внутренние ссылки распределяют ссылочный вес между страницами и помогают поисковику обходить сайт. Пустые анкоры и ссылки на запрещённые robots.txt страницы — типичные ошибки.
Внутренних ссылок на странице 37 оптимально.
На странице присутствуют изображения 1.
Показать внутренние ссылки
| Url | Анкор | Состояние |
|---|---|---|
| /misconceptions |
countering misconceptions
|
|
| /applying-hardware |
what about applying this to hardware?
|
|
| /patents |
Software patents and application programmer interface (API) copyrights
|
|
| /credits |
credit where credit is due
|
|
| /talking-about |
who’s talking about it?
|
|
| /real-world |
real-world application of DDC
|
|
| /related |
some related material
|
|
| /dissertation/html/wheeler-trusting-trust-ddc.html |
Fully Countering Trusting Trust through Diverse Double-Compiling
|
|
| /dissertation/wheeler-trusting-trust-ddc.pdf |
PDF version
|
|
| /dissertation/html/wheeler-trusting-trust-ddc.html |
HTML version
|
|
| /dissertation/wheeler-trusting-trust-ddc.odt |
OpenDocument text version
|
|
| /dissertation/wheeler-trusting-trust-video.html |
The video
of my official public defense
|
|
| /countering-trusting-trust.rss |
podcast/RSS available
|
|
| /dissertation/fully-countering-trusting-trust-ddc-presentation.pdf |
PDF
|
|
| /dissertation/fully-countering-trusting-trust-ddc-presentation.odp |
OpenDocument (ODP)
|
|
| /dissertation-errata.html |
<b>dissertation errata</b>
|
|
| /wheelerd-trust.pdf |
Countering Trusting Trust through Diverse Double-Compiling (DDC)
|
|
| /acsac-countering-trusting-trust-20050922-alt.pdf |
this alternative PDF of
“Countering Trusting Trust through Diverse Double-Compiling (DDC)”
|
|
| /acsac-countering-trusting-trust-20050922.odt |
OpenDocument form of
“Countering Trusting Trust through Diverse Double-Compiling (DDC)”
|
|
| /acsac2005-can-post.txt |
I have the rights to publish it here
|
|
| /counter-trusting-trust-presentation-20060228.pdf |
PDF format
|
|
| /counter-trusting-trust-presentation-20060228.odp |
OpenDocument format
|
|
| /tcc.html |
see my Tiny C Compiler (tcc) page for
how to duplicate the ACSAC experiment, as well as
other tcc-related work too
|
|
| /trusting-trust/dissertation |
see the
separate page on detailed data for the PhD dissertation
|
|
| /essays/software-patents.html |
my
page on software patents
|
|
| /formal_methods/how-to-prove-stuff.html |
“How to prove stuff automatically”
|
|
| /spencer-19981123.txt |
original idea
was dreamed up by the amazingly bright Henry Spencer
|
|
| /user-union/ |
user-union
|
|
| /auto-destdir/ |
auto-destdir
|
|
| /ftp://ftp.cs.indiana.edu/pub/scheme-repository/doc/pubs/vlisp/README |
Vlisp README
|
|
| /essays/make.html |
Improving make
|
|
| /misc/gmu-sample-format.odt |
OpenDocument template for George Mason University (GMU)
|
|
| /mortality.pvs |
Mortality.pvs is a short demo of how to
express the “All men are mortal” example using PVS
|
|
| /education-timeline.html |
my formal education timeline
|
|
| /secure-programs |
my book on
writing secure programs
|
|
| /flawfinder |
FlawFinder
|
|
|
my home page
|
|
Внешние ссылки
Кол-во: 213
Ссылки на сторонние сайты
?
Исходящие внешние ссылки передают часть ссылочного веса на чужие сайты. Ссылки на авторитетные ресурсы безопасны; ссылки на мусорные сайты могут навредить репутации страницы.
Внешних ссылок на странице 213 слишком много. Спрячьте лишние ссылки в тег noindex или атрибут rel='nofollow'!
Показать первые 100 внешних ссылок
| Url | Анкор |
|---|---|
| perma.cc |
Perma.cc link to PDF
|
| arxiv.org |
arXiv:1004.5534 of PDF
|
| mars.gmu.edu |
GMU Mason Archival
Repository Service (MARS)
|
| gmu.edu |
George Mason University
|
| itu.gmu.edu |
Innovation Hall
|
| itu.gmu.edu |
location on campus
|
| maps.google.com |
Google map
|
| dl.acm.org |
Reflections
on Trusting Trust
|
| web.archive.org |
Countering Trusting Trust through Diverse Double-Compiling
|
| web.archive.org |
Annual Computer
Security Applications Conference
|
| earlham.edu |
open access
|
| libreoffice.org |
LibreOffice
|
| openoffice.org |
OpenOffice.org
|
| opendocumentfellowship.org |
support the OpenDocument standard
|
| academiccommons.columbia.edu |
“Reproducible Research: Addressing the Need for Data and Code Sharing in Computational Science” by Victoria C. Stodden (Computing in Science & Engineering, 2010)
|
| en.wikipedia.org |
replication crisis in science
|
| medium.com |
Why most of psychology is statistically unfalsifiable
|
| journals.sagepub.com |
"False-Positive Psychology: Undisclosed
Flexibility in Data Collection and Analysis
Allows Presenting Anything as Significant" by
Joseph P. Simmons, Leif D. Nelson, and Uri Simonsohn
|
| en.wikipedia.org |
fat binaries
|
| lwn.net |
“Analysis of inherent randomness of the Linux kernel”
|
| infoq.com |
Microsoft Visual Studio 2015 Update 2 was quietly inserting telemetry calls into compiled programs by default
|
| semiwiki.com |
Semiconductor IP Validation Gets Faster
|
| people.umass.edu |
“Stealthy Dopant-Level Hardware Trojans”
by Georg T. Becker, Francesco Regazzoni, Christof Paar,
and Wayne P. Burleson
|
| schneier.com |
Bruce Schneier briefly discusses this
|
| crosstalkonline.org |
“Integrated Circuit Security Threats and Hardware Assurance Countermeasures” by Karen Mercedes Goertzel (CrossTalk, November/December 2013)
|
| academia.edu |
alternate URL
|
| static1.1.sqspcdn.com |
"A2: Analog Malicious Hardware" by Kaiyuan Yang, Matthew Hicks, Qing Dong, Todd Austin, and Dennis Sylvester
|
| wired.com |
Researchers at University of Michigan demonstrated in 2016 a sabotaged processor called A2
|
| spectrum.ieee.org |
"X-Ray Tech Lays Chip Secrets Bare" by Samuel K. Moore (<i>IEEE Spectrum</i>, 2019-10-07
|
| dx.doi.org |
ptychographic
X-ray laminography
|
| youtube.com |
The Growing Semiconductor Design Problem
|
| groklaw.net |
Oracle v. Google “Order RE Copyrightability
of Certain Replicated Elements of the Java Application programming Interface”
of 2012
|
| groklaw.net |
Groklaw
has this as text
|
| curia.europa.eu |
in SAS Institute v. World Programming Ltd., Judgment in Case C-406/10, that “The functionality of a computer program and the programming language cannot be protected by copyright.”
|
| curia.europa.eu |
Here are the actual judgements of C-406/10
|
| people.ischool.berkeley.edu |
“Why Copyright Law Excludes Systems and
Processes from the Scope of Its Protection” by Pamela Samuelson
|
| eff.org |
Computer Scientists Ask Supreme Court to Rule APIs Can’t Be Copyrighted
|
| quora.com |
Mike Stute's answer to
"What is a coder's worst nightmare?"
|
| ieee-security.org |
Paul Karger died in 2010
|
| nku.edu |
CSC 593: Secure Software Engineering Seminar
|
| dl.acm.org |
<i>Reflections
on Trusting Trust</i>
|
| ls6-www.informatik.uni-dortmund.de |
Technische Universitat Dortmund’s
Lehrstuhl Informatik VI (Dr. Ulrich Flegel and Dr. Michael Meier)
(WS 2007/2008)
|
| linuxluddites.com |
Linux Luddites
podcast #21 (August 2,2014) starting at 1:41
|
| google.com |
“Increasing Open Source Software Integration
on the Department of Defense Unclassified Desktop”
by Steven Anthony Schearer (June 2008), a
Naval Postgraduate School (NPS) thesis
|
| docs.di.fc.ul.pt |
“How Practical Are Intrusion-Tolerant Distributed Systems?”
by Obelheiro et al.
(Sep 2006), Department of Informatics, University of Lisbon
|
| epublications.bond.edu.au |
the PhD thesis
“Tamper-resistant Peer-to-Peer Storage for File Integrity Checking”
by Alexander Zangerl, Bond University, School of Information Technology
(August 2006)
|
| seclists.org |
Bugtraq
|
| catless.ncl.ac.uk |
comp.risks (the Risks digest)
|
| schneier.com |
Bruce Schneier’s weblog (the source for Crypto-Gram)
|
| lambda-the-ultimate.org |
Lambda the ultimate
|
| securecoding.org |
SC-L (the Secure Coding mailing list)
|
| linuxsecurity.com |
LinuxSecurity.com
|
| chi-publishing.com |
Chi Publishing’s Information Security Bulletin
|
| en.wikipedia.org |
Wikipedia’s “Backdoor”
article
|
| sourceforge.net |
Open Web Application Security Project (OWASP) (mailing list)
|
| schneier.com |
Bruce Schneier’s page in particular
includes a lengthy commentary about it
|
| leuf.net |
Open Source is Securable
|
| imgur.com |
BartK’s “Defeating the Trust Attack”
|
| reddit.com |
a spirited reddit discussion
in September 2013
|
| news.ycombinator.com |
There was a lively
discussion of the dissertation on Y Combinator's "Hacker News"
in October 2016
|
| diva-portal.org |
<i>Diverse Double-Compiling to Harden Cryptocurrency Software</i>
by Niklas Rosencrantz, 2023, KTH, School of Electrical Engineering and Computer Science (EECS)
|
| youtube.com |
The Original Sin of Computing...that no one can fix
|
| gnu.org |
GNU Mes
|
| reproducible-builds.org |
Reproducible bootstrap of Mes C compiler
|
| rsaconference.com |
"Countering Development Environment Attacks"
at the 2015 RSA Conference in San Francisco
|
| umontreal.scholaris.ca |
"A Fully Reproducible C Toolchain Rooted on POSIX Shell"
(Laurent Huberdeau)
|
| niconiconi.neocities.org |
Ken Thompson Really Did Launch His "Trusting Trust" Trojan Attack in Real Life
|
| mail-archive.com |
mail-archive.com
|
| groups.google.com |
Google Groups
|
| research.swtch.com |
"Running the 'Reflections on Trusting Trust' Compiler" by
Russ Cox (2023-10-25)
|
| research.swtch.com |
experiment with
this attack on a web-based simulator
|
| tuhs.org |
post by Ken Thompson on 2021-09-20 titled
"[TUHS] Thompson trojan put into practice"
|
| news.ycombinator.com |
discussed in Hacker News
|
| securitylab.github.com |
"The Octopus Scanner Malware: Attacking the open source supply chain"
by Alvaro Muñoz (2020-05-28)
|
| spectrum.ieee.org |
"Operation ShadowHammer Exploited Weaknesses in the Software Pipeline"
by Fahmida Rashid, <i>IEEE Spectrum</i>, 1 May 2019
|
| fireeye.com |
over 4,000 Apple iOS applications were subverted and got
into the Apple app store
|
| 9to5mac.com |
popular applications were infected via XCodeGhost
|
| cnbc.com |
CNBC reported
|
| reuters.com |
Reuters carried a similar report
|
| en.wikipedia.org |
XcodeGhost<p>
<a href="http://manishearth.github.io/blog/2016/12/02/reflections-on-rusting-trust/">Manish Goregaokar's "Reflections on Rusting Trust"</a>
demonstrates an implementation of the "trusting trust" attack in the
Rust programming language.
This isn't an attack, it's a demo of the attack, but it's a nice demo.
There's a
<a href="https://news.ycombinator.com/item?id=13091941">Hacker News</a>
and
<a href="https://www.reddit.com/r/rust/comments/5g5hib/reflections_on_rusting_trust/">Reddit</a>
discussion of it.
<p>
<a href="https://theoutline.com/post/1953/how-a-vc-funded-company-is-undermining-the-open-source-community">"How a VC-funded company is undermining the open-source community" (<i>The Outline</i>, 2017)</a>
makes a number of claims about
actions of Kite, a venture capital-funded startup.
The article states that that Kite has been
modifying developer tools for Kite's benefit.
It's not the same as the trusting trust attack at all, but
it does suggest that tools for developers are a potential target.
<!--
In 2015, the article
<a href="https://firstlook.org/theintercept/2015/03/10/ispy-cia-campaign-steal-apples-secrets/">"The CIA Campaign to Steal Apple’s Secrets"
by Jeremy Scahill and Josh Begley (<i>The Intercept</i>)</a>
said there had been a
"multi-year, sustained effort to break the security
of Apple's iPhones and iPads" and that one vector was that they
"had created a modified version of Apple’s proprietary
software development tool, Xcode,
which could sneak surveillance backdoors into any apps or programs
created using the [XCode] tool."
<a href="https://www.schneier.com/blog/archives/2015/03/how_the_cia_mig.html">Bruce Schneier commented on the article</a>;
he commented that
it's "a classic application of Ken Thompson's work".
<a href="https://freedom-to-tinker.com/blog/dwallach/on-compromising-app-developers-to-go-after-their-users/">Dan Wallach goes into more detail on
how subversion of XCode could work</a>.
-->
<h2 id="safe-builds">Safe builds</h2>
<p>
It's important to build software in a safe way.
<p>
<a href="https://www.qubes-os.org/news/2016/05/30/build-security/">Security challenges for the Qubes build process</a>
has an interesting discussion.
They state their goals as:
<ol>
<li>"We want to build (and distribute) non-backdoored software.
<li>We don’t want the build process itself to be able to compromise the developer’s machine."
</li></ol>
<p>
To do this, they focus on these tasks:
<ol>
<li>"To perform verification of all the input sources, git repo commits, and other components (such as the stock RPMs and DEBs we also use), i.e. that they have proper digital signatures created by the select keys that we chose to trust."
<li>"Provide strong sandboxes for building the less trusted parts of the Qubes OS, such as the various templates, so that even if the (properly signed) sources or other components turn out to be malicious*, the rest of the generated system, such as the Xen hypervisor and dom0, are not affected (nor is the developer’s machine)."
</li></ol>
<p>
They include this important footnote: "* Of course, one should understand that the mere fact that packages or sources are properly signed, even with key(s) we have decided to trust, doesn’t guarantee that the code has not been backdoored. This could happen if one of the developers turned out to be malicious or was somehow coerced to introduce a backdoor, e.g. via some kind of a warrant or blackmail, or if their laptop were somehow compromised. We would like to defend against such potential situations."
<h2 id="reproducible"><span id="reproduceable">Reproducible (deterministic) builds</span></h2>
<p>
Creating <a href="https://reproducible-builds.org">reproducible builds</a>
(aka deterministic builds)
is an excellent way to detect many development-time attacks, and
is a precondition for applying DDC.
The <a href="https://reproducible-builds.org">reproducible-builds.org</a>
web site has some great information on the topic.
The video
<a href="https://www.youtube.com/watch?v=ooJXRBf72M0">Reproducible builds: Two years in the trenches (2017)</a>
summarizes their work.
They developed a tool called
<a href="https://diffoscope.org/">diffoscope</a> that I wish I'd had!
See below for more about the related topic
<a href="#semantically_reproducible">semantically reproducible builds</a>.
<p>
Here are a few pointers you may find useful.
<p>
The Tails Operating System image is reproducible.
<a href="https://tails.net/contribute/build/reproducible/">Verifying a Tails image for reproducibility</a>
describes the process to independently reproduce and verify an image.
<p>
<a href="https://www.linuxfoundation.org/en/blog/preventing-supply-chain-attacks-like-solarwinds/">"Preventing Supply Chain Attacks like SolarWinds" (Linux Foundation
blog post) by David A. Wheeler (me!)</a>
discusses how to counter subverted build processes, like that in SolarWinds,
by using <i>verified reproducible builds</i>.
Basically, use reproducible builds to <i>independently verify</i> that
your build result is correct.
For a detailed technical discussion on how SolarWinds Orion was
subverted, including a discussion of
SUNSPOT (the malware that inserted the backdoor) and
SUNBURST (the backdoor itself), see
<a href="https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/">"SUNSPOT: An Implant in the Build Process" by the
CrowdStrike Intelligence Team (2020-01-11)</a>.
<p>
<a href="https://core.telegram.org/reproducible-builds">Telegram supports reproducible builds</a> so that others can verify that
its open source code is the same as the code available in the
Apple App Store and Google Play.
As of early 2021 it's considered "somewhat experimental".
<a href="https://core.telegram.org/reproducible-builds#reproducible-builds-for-ios">Telegram notes that Reproducible Builds are especially hard for iOS</a>
due to Apple's current policies and MacOS limitations.
As they say:
(1) "Apple insists on using FairPlay encryption to “protect” even
free apps from “app pirates” which makes obtaining the executable
code of apps impossible without a jailbroken device." and (2)
"macOS doesn't support containers like Docker."
It's still possible, but challenging.
<p>
<a href="https://csrc.nist.gov/CSRC/media/Projects/cyber-supply-chain-risk-management/documents/SSCA/Fall_2019/WedAM1.1_Source_and_Executable_Core.pdf">"Source and Executable" by Mike Lai (Microsoft)</a>
discussed reproducible builds and
was given at the NIST/DHS Software and Supply Chain Assurance (SSCA)
Forum in late 2019.
<p>
I've been told that the
the Russian “Non-Documented Functionality” (NDF) certification regime
may have specifically required demonstrating a reproducible build,
and that at least at one time Microsoft did meet these NDF requirements.
However, I have not been able to confirm this.
One problem is that I don't speak Russian.
Maybe someone can look at sites such as this
<a href="https://npo-echelon.ru/en/company/echelon/">Echelon</a> site to confirm this?
<p>
<a href="https://www.duo.uio.no/bitstream/handle/10852/65737/thesis_yrjan_skrimstad.pdf">"Improving Trust in Software through Diverse Double-Compiling and
Reproducible Builds" by Yrjan Skrimstad (University of Oslo, 2018)</a>
is perhaps the closest paper to my work (since it builds on it).
In my work I noted that it was possible to use more than one "trusted"
compiler (that is, more than 2 grandparent compilers)
to increase the difficulty for the attacker.
This work by Yrjan Skrimstad expands that further, discussing
implications when there are more than two such compilers.
It demonstrates the trusting trust attack (using a quine)
in the Go programming language, and then
and demonstrates how to use DDC (with 3 grandparents) to detect the attack.
It also discusses the relationship between DDC and reproducible builds.
This work by Yrjan Skrimstad is demonstrated in the
<a href="https://github.com/yrjan/untrustworthy_go">GitHub repo yrjan/untrustworthy_go</a>.
<p>
The Tor project is very concerned about reproducible (deterministic) builds:
<ul>
<li>
<a href="https://mailman.stanford.edu/pipermail/liberationtech/2013-June/009257.html">Mike Perry of the Tor project explained on 2013-06-18</a>
that,
“I didn’t spend six agonizing weeks (and counting)
getting deterministic builds to work for
Tor Browser to prove that I was honest or trustworthy.
I did it because I don’t believe that software development
models based on single party trust can actually be secure against
serious adversaries anymore, given the current trends in computer
security and ‘cyberwar’...
I don’t believe it is possible to
keep a software-based GPG key secure anymore,
nor do I believe it is possible to keep even an
offline build machine secure from malware injection anymore...
This is where deterministic builds come in:
any individual can use our anonymity network
to download our source code, verify it against public
signed, audited, and mirrored git repositories,
and reproduce our builds exactly...
Otherwise, I really don’t think we’ll have working computers left in
5-10 years from now :/.”
Deterministic builds aren’t enough if the compiler executable is
subverted, but thankfully, DDC enables multi-party verification
of compiler executables (you still have to check the source, but
that is a much easier problem).
</li>
<li>
<a href="https://blog.torproject.org/blog/deterministic-builds-part-one-cyberwar-and-global-compromise">Deterministic Builds Part One: Cyberwar and Global Compromise</a> and
<a href="https://blog.torproject.org/blog/deterministic-builds-part-two-technical-details">Deterministic Builds Part Two: Technical Details</a>
has a lot of material about Tor and deterministic builds.
</li>
</ul>
<p>
The
<a href="https://autobuilder.yoctoproject.org/typhoon/#/builders/117">Yocto project not only has reproducible builds, but its CI/CD
pipeline <i>verifies</i> that every build is reproducible</a>.
<p>
<a href="http://blogs.kde.org/2013/06/19/really-source-code-software">
“Is that really the source code for this software?” by Jos van den Oever
(2013-06-19)</a>
posts about the problems of trying to
recreate executables from source code.
Sometimes it’s not so bad, e.g., for Debian,
“The binary package that was built from a Debian source package was
not identical to the published binary package, but the differences are
limited to timestamps and the build id in the executables.”
But sometimes it’s very difficult, just as I had found years earlier,
because you often need a lot more build information than you can get.
You need much more than the source code and build script; you need
to know the exact versions of all relevant build software, its
configuration, and so on.
But it is <i>possible</i> to record all that information, so that the
process can be repeated... and you can repeat the process to make sure
that you got it all.
If you record that information, then you have the problem of
“how do I know that my build tools are not malicious?”
At that point, DDC comes to the rescue... because DDC can help you
verify that.
<p>
<a href="https://link.springer.com/article/10.1007/s11219-022-09607-z">"On business adoption and use of reproducible builds for open and closed source software" by Simon Butler, Jonas Gamalielsson, Björn Lundell, Christoffer Brax, Anders Mattsson, Tomas Gustavsson, Jonas Feist, Bengt Kvarnström & Erik Lönroth , 2022-11-29, Software Quality Journal</a>
discusses reproducible builds from a business point of view.
"Through interviews with software practitioners and business managers,
this study explores the utility of applying R-Bs in businesses in
the primary and secondary software sectors and the business and
technical reasons supporting their adoption. We find businesses use
R-Bs in the safety-critical and security domains, and R-Bs are
valuable for traceability and support collaborative software
development. We also found that R-Bs are valued as engineering
processes and are seen as a badge of software quality, but without
a tangible value proposition. There are good engineering reasons
to use R-Bs in industrial software development, and the principle
of establishing correspondence between source code and binary offers
opportunities for the development of further applications."
This is an open access paper, so anyone can read it.
<p>
The <a href="https://wiki.debian.org/ReproducibleBuilds">Debian ReproducibleBuilds project</a>
has the goal of making it
possible to reproduce, byte for byte, every build of every package in Debian.
They have made a <i>lot</i> of progress, and I am
really delighted to see it.
Their
<a href="https://reproducible.debian.net/index_issues.html">Overview of known issues related to reproducible builds</a>
shows what commonly causes problems;
these include embedded generated timestamps from various causes
(this is a big one) and
random/unsorted ordering.
For example,
<a href="https://reproducible-builds.org/specs/source-date-epoch/">SOURCE_DATE_EPOCH specification</a>
provides a simple mechanism to turn complicated timestamp issues into
something simple.
Also, the
<a href="http://sources.debian.net/">sources.debian.net</a> site
provides convenient browsing access to the Debian source code.
<a href="http://motherboard.vice.com/read/how-debian-is-trying-to-shut-down-the-cia-and-make-software-trustworthy-again">How Debian Is Trying to Shut Down the CIA and Make Software Trustworthy Again</a> also discusses this.
<p>
<a href="https://securityblog.redhat.com/2013/09/18/reproducible-builds-for-fedora/">Reproducible Builds for Fedora</a> is a similar project to
deterministically reproduce the packages of Fedora.
<p>
<a href="https://f-droid.org/">F-Droid</a> and
<a href="https://guardianproject.info/">The Guardian Project</a>
are working on reproducible builds for Android.
For more information, see
<a href="https://lwn.net/Articles/633106/">LWN.net</a>,
<a href="https://guardianproject.info/2014/06/09/our-first-deterministic-build-lil-debi-0-4-7/">info on the first reproducible build by Guardian (a developers' tool)</a>,
<a href="https://guardianproject.info/2015/02/11/complete-reproducible-app-distribution-achieved/">their success with the utility app Checkey</a>.
<p>
<a href="https://madiba.encs.concordia.ca/~x_decarn/truecrypt-binaries-analysis/">How I compiled TrueCrypt 7.1a for Win32 and matched the official binaries</a> describes a deterministic build (with explanable differences)
was achieved for TrueCrypt.
This is an encryption software capable of on-the-fly
encryption on file-, partition- or disk-based virtual disks, yet its
authors are anonymous, leading some to worry that the executables
were backdoored.
Note: Though its source code is visible, it does not use a standard OSS
license and it imposes restrictions that probably mean is it is not OSS;
<a href="http://lists.freedesktop.org/archives/distributions/2008-October/000276.html">it is not considered FLOSS by many major Linux distributions
including Debian, Ubuntu, Fedora, openSUSE, and Gentoo</a>.
More recently, the TrueCrypt developers have stopped development, and
its lack of a real OSS license may inhibit anyone else supporting it.
<p>
<a href="https://gitian.org/">Gitian</a>
is a “secure source-control oriented software distribution method
[so] you can download trusted binaries
that are verified by multiple builders.”
<p>
<a href="https://www.vagrantup.com/">Vagrant</a>
is designed to "create and configure
lightweight, reproducible, and portable development environments".
<a href="http://opensource.com/business/15/9/ato-interview-seth-vargo">Seth Vargo</a> discusses it briefly.
<p>
The paper
<a href="https://gatowololo.github.io/resources/publications/dettrace.pdf">"Reproducible Containers" by Omar S. Navarro Leija et al</a>
will be presented in March 2020 at the
25th International Conference on Architectural Support for
Programming Languages and Operating Systems (ASPLOS) 2020
(this is a conference of the Association for Computing Machinery (ACM)).
This paper "describes DetTrace, a reproducible container abstraction for
Linux implemented in user space."
This looks <i>really</i> promising.
The
<a href="https://github.com/dettrace/dettrace">implementation is OSS (MIT license)</a>.
<!--
https://asplos-conference.org/wp-content/uploads/2020/abstracts/paper_2_0.html
-->
<p>
<a href="http://buildroot.net">Buildroot</a> is a simple mechanism for
creating embedded Linux systems through cross-compilation.
<p>
<a href="http://ball.askemos.org/">Byzantine Askemos Language Layer (BALL)</a>
is an implementation of the
<a href="http://askemos.org/">Askemos Distributed Virtual Machine</a>.
It creates an “autonomous virtual execution environment for applications”
which unlike traditional cloud environments is
specifically designed to provide fault tolerance and
to be tamper-proof.
It executes the code on several different machines,
runtime libraries, compilers, operating systems and so on
in parallel and compares cryptographic signatures.
Thus, this tries to counter subversion of various lower-level components.
<p>
Christophe Rhodes has discussed
the problems of reproducing builds of Steel Bank Common Lisp (SBCL)
on different systems in
<a href="http://christophe.rhodes.io/notes/blog/posts/2014/still_working_on_reproducible_builds/">Still working on reproducible builds</a>
and
<a href="http://christophe.rhodes.io/notes/blog/posts/2014/reproducible_builds_-_a_month_ahead_of_schedule/">Reproducible builds - a month ahead of schedule</a>.
While his notes are specific to SBCL, they illustrate more general issues.
He notes that one of the reasons that SBCL separated from its parent
CMCL was to
"make the result of its build
be independent of the compiler used to build it."
His goal was not primarily to counter attack, but to eliminate
hard-to-find bugs:
"... how do we know there aren't odd differences that depend
on the host compiler lurking,
which will not obviously affect normal operation but will
cause hard-to-debug trouble later? (In fact there were plenty of those, popping up at inopportune moments).
I’ve been working intermittently on dealing with this, by attempting to
make the Common Lisp code that SBCL!Compiler is written in sufficiently
portable that executing it on different implementations generates
bitwise-identical output. Because then, and only then, can we be
confident that we are not depending in some unforseen way on a particular
implementation-specific detail...".
Here are some of the issues that he (and perhaps other
the SBCL developers) found and fixed, as an example of what to look for:
<ol>
<li>The Common Lisp specification permits implementations to compute
<tt>(write-to-string '(quote foo) :pretty nil)</tt>
as either <tt>"(QUOTE FOO)"</tt> or <tt>"'FOO"</tt>.
To create a reproducible build
they had to use a workaround (involving function name counters)
so that the difference would not matter.
<li>A related problem happens with backquote: the Common Lisp specification
allows implementations to determine if values coalesce, but this
can produce different results; the solution is to change the code
so that its results are guaranteed.
<li>The various set-related functions
(e.g., set-difference, uniion, intersection, etc.) do not
return sets in an order, which can result in differing builds.
The solution is to sort the result of set operations, to force them
to a specific known order.
<li>A call to maphash was used to affect the Lisp image directly.
In general, hash tables do not guarantee any particular order when you
walk their contents, so you need to force an ordering if you iterate
over their contents.
<li>Implementation-defined constants, especially
most-positive-fixnum and most-negative-fixnum,
but also array-dimension-limit and internal-time-units-per-second.
<li>Some functions like random and sxhash are understably different,
which cause access patterns to differ.
<li>The <tt>sort</tt> routine in Lisp is not specified to be stable,
so when trying to make it deterministic with multiple stages,
<tt>stable-sort</tt> should be used instead.
<li>Initial values of arrays are undefined, so don't depend on their value!
</li></ol>
<p>
The key thing to note is that creating compilers that can easily
have reproducible (deterministic) builds on other compilers
typically takes work in the real world... but it is very doable.
<p>
There are various tools that can help you create reproducible builds.
For example, if build paths are embedded, you can force fixed
directory values to make them reproducible.
There are tools that enable this without requiring root permission,
including my tools
<a href="https://dwheeler.com/user-union/">user-union</a>
and
<a href="https://dwheeler.com/auto-destdir/">auto-destdir</a>,
as well as tools like
<a href="http://proot.me/">proot</a>.
<p>
LF-Edge EVE has worked hard on reproducibility.
See <a href="https://github.com/lf-edge/eve/blob/master/docs/EVE-IMAGE-REPRODUCIBILITY.md">EVE image reproducibility</a> and
<a href="https://github.com/lf-edge/eve/blob/master/docs/EVE-IMAGE-SOURCES.md">EVE image sources</a> for an interesting example of
how to implement higher standards.
<h2 id="semantically_reproducible">Semantically equivalent builds</h2>
<p>
Reproducible builds are great for showing that a package really was built
from some given source, but sometimes they're hard to do.
A useful backoff is something called a "semantically equivalent build".
<p>
As explained in the documentation for the
<a href="https://github.com/microsoft/OSSGadget/tree/main/src/oss-reproducible/README.md">oss-reproducible tool</a>
(part of <a href="https://github.com/microsoft/OSSGadget/">OSSGadget</a>),
"A project build is <i>semantically equivalent</i>
if its build results can be either recreated exactly (a bit for bit
<a href="https://en.wikipedia.org/wiki/Reproducible_builds">reproducible build</a>,or if the differences between the release package and a rebuilt package are not expected to produce functional differences in normal cases.
For example, the rebuilt package might have different date/time stamps, or one might include files like .gitignore that are not in the other and would not change the execution of a program under normal circumstances."
<p>
A semantically equivalent build has very low risk of being a subverted build
as long as it's <i>verified</i> to be semantically equivalent.
Put another way, verifying that a package has a semantically equivalent build
counters the risk where the putative source code isn't malicious, but
where someone has tampered with the build or distribution process,
resulting in a built package that <i>is</i> malicious.
It's quite common for builds to produce different date/time stamps, or
to add or remove "extra" files that would have no impact if the original
source code was not malicious.
<p>
It's <i>much</i> easier (and lower cost) for software
developers to create a semantically equivalent build instead of always
creating a fully reproducible build.
Fully reproducible builds are still a gold standard for verifying
that a build has not been tampered with.
However, creating fully reproducible builds often require that package
creators change their build process, sometimes in substantive ways.
In many cases a semantically equivalent build requires no changes,
and even if changes are required, there are typically fewer changes required.
<p>
<a href="https://github.com/microsoft/OSSGadget/">OSSGadget</a>
includes a tool that can determine if a given package is
semantically equivalent.
It's still helpful to work to make a package a fully reproducible build.
A fully reproducible build is a somewhat stronger claim, and
you don't need a complex tool to determine if the package is fully
reproducible.
Even given that, it's easier to first create a package that's
semantically equivalent, and <i>then</i> work on the issues remaining
to make it a fully reproducible build.
<p>
The intended use case for semantically equivalent builds
(instead of fully reproducible builds)
really to help people make risk decisions when they're thinking
about bringing in external software.
I'm primarily trying to deal with the case where the developer has decided
to <i>not</i> provide a reproducible build,
and I have to estimate the likelihood
of it being maliciously built (presumably as a part of decideing whether or not
the package is safe to install). I'm primarily thinking of
applying this process to mostly-unmanaged repositories
like npm, PyPI, and RubyGems, *not* to managed repositories like
most Linux distributions' repositories (which have other
mechanisms to counter malicious builds).
The problem is that I cannot make the developer
provide me a reproducible build (I can beg, but that's not the same thing).
I'm trying to make good decisions with the information I have,
not the information I *want* to have.
<p>
The threat model is a little different, too. The assumption isn't that
"it is impossible for these differences to cause damage".
The assumption is that "the original source code was benign,
reasonably coded, and did not do damage". The question is,
"is this non-reproducible
package likely to have been generated from it, even though it's
not a reproducible build?"
<p>
Here's an example that might clarify the threat model.
It's possible that a
program could look for the file ".gitignore" and run it if present.
The source code repo might not have a .gitignore file,
but the malicious package might add a .gitignore file and fill it with
a malicious application. That would cause malicious code to
be executed. However, it would also be *highly* suspicious for
the source code to
run a ".gitignore" file (that's *not* what they are for), so
it's reasonable to assume that the source code didn't do that.
If an attacker can insert a file that *would* cause malicious code
to execute in a reasonably-coded app, then that *would* be a problem.
"What's reasonable" is hard to truly write down, but
ignoring date/time stamps and ignoring a
whitelisted list of specific filenames seems like a reasonable place
to start.
<p>
Sure, ideally everything would have a reproducible build.
Since that day isn't here, what can we do to take piecemeal
steps towards that?
<p>
In short, making packages at least semantically equivalent
(and verifying this) is a great countermeasure against subverted builds.
<h2 id="boostrappable">Bootstrappable builds</h2>
<p>
<a href="http://bootstrappable.org/">Bootstrappable builds</a>
focuses on minimizing the amount of bootstrap binaries.
They're not just interested in the direct "bootstrap" code
to boot a computer, but also what is necessary to generate the
direct bootstrap code.
The problem bootstrappable builds is trying to address is a real one,
namely, they are worried about subverted bootstrap code.
<p>
In the ideal sense they want to build up
"compilers and interpreters and tools from nothing" - but of course
you can't <i>really</i> build up from nothing - there has to be
a starting point.
DDC provides a great complement to bootstrappable builds -
bootstrappable builds tries to limit the binaries you depend on, and
DDC can be used to verify the those binaries that you depend on.
<p>
One example of this approach is
<a href="https://github.com/oriansj/stage0">stage0</a>.
<p>
Another example is
<a href="https://github.com/ironmeld/builder-hex0">builder-hex0</a>,
a kernel "for bootstrapping compilers without having to
trust a prebuilt binary".
They are now able to bootstrap a POSIX kernel from Hex0 and use it
to bootstrap a cross-platform C compiler with it.
<h2 id="formal-methods">Formal methods / proofs</h2>
<p>
Coq is being used by Xavier Leroy (main developer of OCaml) to write a
certified compiler,
<a href="http://pauillac.inria.fr/~xleroy/research.html#compcert">
compcert</a>, that guarantees that semantics of a C
source program is kept up to PowerPC assembly.
<a href="http://pauillac.inria.fr/~xleroy/compcert-backend/">
The *specification* (unfortunately not the Coq proofs) of the
compiler back-end is available as GPL software</a>.
<p>
You might also be interested in the results of the MITRE Vlisp project.
<a href="ftp://ftp.cs.indiana.edu/pub/scheme-repository/doc/pubs/vlisp/README">
Vlisp README</a> says:
“The Verified Programming Language Implementation project has developed
a formally verified implementation of the Scheme programming language,
called Vlisp... An overview of the project is
presented in the Vlisp Guide.
<a href="http://library.readscheme.org/">
More accessible PDFs about Vlisp are available too</a>.
<!--
You can obtain paper copies of these
reports by sending a request to ramsdell@mitre.org, or to the
following U. S. Mail address:
John D. Ramsdell
MS A118
The MITRE Corporation
202 Burlington Road
Bedford MA, 01730-1420 "
-->
Another paper that you may find interesting is
<a href="http://www.swiss.ai.mit.edu/ftpdir/users/jar/archive/whole.ps">
Jonathan A. Rees. “A Security Kernel Based on the Lambda-Calculus”.
PhD. Thesis. February 1995</a>.
<h2>Underhanded code / Malicously-misleading code</h2>
<p>
In my PhD dissertation I note the problem of code that intentionally written
to look (to a human) like it does one thing, but actually does another.
In my dissertation I called this "maliciously-misleading code"; more recently
the term "underhanded code" seems to have become more common.
Either way, it's not a good thing.
There are contests such as the
Obfuscated V Contest and Underhanded C Contest
showing that it's very possible, and a 2003 attempted attack on the Linux
kernel shows that it is not merely an academic issue.
<p>
If you are interested in the topic of underhanded code,
I suggest looking at my paper
<a href="https://www.ida.org/-/media/feature/publications/i/in/initial-analysis-of-underhanded-source-code/d-13166.ashx">“Initial Analysis of Underhanded Source Code”
by David A. Wheeler, IDA Document D-13166, April 2020</a>
(here's a <a href="https://perma.cc/FVQ8-EKWA">Perma.cc link to the
PDF of D-13166</a>).
<h2>Building (more) trusted hardware</h2>
<p>
A related issue is developing (more) trusted hardware.
Since it's much harder to determine if hardware is "equivalent" there are
many ways an attacker can subvert hardware that aren't a trusting trust attack.
It's especially easy to subvert an ASIC mask, and unfortunately it's hard to
detect. Those who control foundries can easily insert attacks that
are hard to detect.
I can't cover this huge field, but I thought I should make a few notes about it.
<p>
First, it's well-known that it's possible to insert attacks on hardware
that are hard to detect later.
E.g.,
"<a href="https://www.ieee-security.org/TC/SP2016/papers/0824a018.pdf">A2: Analog Malicious Hardware</a>”
showed "how a fabrication-time attacker can
leverage analog circuits to create a hardware attack that is
small (i.e., requires as little as one gate) and stealthy (i.e.,
requires an unlikely trigger sequence before effecting a chip’s
functionality)."
It won “best paper” at the 37th IEEE Symposium on Security and Privacy
and
<a href="https://www.computerworld.com/article/1673247/researchers-built-devious-undetectable-hardware-level-backdoor-in-computer-chips.html">ComputerWorld had article about it</a>.
<p>
There are <i>some</i> countermeasures. E.g.,
"<a href="https://cseweb.ucsd.edu/~weh140/resource/IEEEComputer_16.pdf">Detecting Hardware Trojans with Gate-Level Information-Flow Tracking</a>”
(IEEE Computer August 2016)
uses information flow tracking to discover hardware Trojans
As noted in a
<a href="https://today.ucsd.edu/story/nowhere_to_hide_uc_san_diego_researchers_devise_proactive_method_for_detect">UCSD article</a>, it works by assigning a label to important data
like a cryptographic key.
That has some value, but it's not a good general-purpose technique
for countering arbitrary Trojans - what if the Trojan isn't trying to
violate that specific property?
<p>
Obviously, what we'd <i>like</i> to have is computers that we can
<i>really</i> trust for important missions, either directly or for use as
checks on "normal" computers.
One approach I've suggested for decades is possibly using FPGAs to implement
some computers. FPGAs can be subverted also, especially to add "kill switches",
but at least the FPGA manufacturer has less information about the chip's use.
<p>
A really interesting set of work is
"<a href="https://www.contrib.andrew.cmu.edu/~somlo/BTCP/">"A Trustworthy, Free (Libre), Linux Capable,
Self-Hosting 64bit RISC-V Computer</a>" by
Gabriel L. Somlo</p>
|
| manishearth.github.io |
Manish Goregaokar's "Reflections on Rusting Trust"
|
| news.ycombinator.com |
Hacker News
|
| reddit.com |
Reddit
|
| theoutline.com |
"How a VC-funded company is undermining the open-source community" (<i>The Outline</i>, 2017)
|
| qubes-os.org |
Security challenges for the Qubes build process
|
| reproducible-builds.org |
reproducible builds
|
| reproducible-builds.org |
reproducible-builds.org
|
| youtube.com |
Reproducible builds: Two years in the trenches (2017)
|
| diffoscope.org |
diffoscope
|
| tails.net |
Verifying a Tails image for reproducibility
|
| linuxfoundation.org |
"Preventing Supply Chain Attacks like SolarWinds" (Linux Foundation
blog post) by David A. Wheeler (me!)
|
| crowdstrike.com |
"SUNSPOT: An Implant in the Build Process" by the
CrowdStrike Intelligence Team (2020-01-11)
|
| core.telegram.org |
Telegram supports reproducible builds
|
| core.telegram.org |
Telegram notes that Reproducible Builds are especially hard for iOS
|
| csrc.nist.gov |
"Source and Executable" by Mike Lai (Microsoft)
|
| npo-echelon.ru |
Echelon
|
| duo.uio.no |
"Improving Trust in Software through Diverse Double-Compiling and
Reproducible Builds" by Yrjan Skrimstad (University of Oslo, 2018)
|
| github.com |
GitHub repo yrjan/untrustworthy_go
|
| mailman.stanford.edu |
Mike Perry of the Tor project explained on 2013-06-18
|
| blog.torproject.org |
Deterministic Builds Part One: Cyberwar and Global Compromise
|
Конкуренты Готовность: 0%
Конкуренты в Яндексе
Кол-во: 0
Топ сайтов-конкурентов в Яндексе
?
Сайты, чаще всего появляющиеся в ТОПе Яндекса по запросам из семантического ядра этой страницы.
Мы не нашли у вас конкурентов в Яндексе. Сайт или очень молодой или плохо продвигается.
Конкурентов в ТОП-10 Яндекса не нашлось.
Конкуренты в Google
Кол-во: 0
Топ сайтов-конкурентов в Google
?
Сайты, чаще всего появляющиеся в ТОПе Google по запросам из семантического ядра этой страницы.
Конкуренты в Google тоже не найдены. Займитесь продвижением сайта!
Конкурентов в ТОП-10 Google не нашлось.
ЗоЗПП: права потребителей Готовность: 100%
Нарушения
Не выявлены
Признаков дистанционной продажи товаров (интернет-магазина) не обнаружено — требования ЗоЗПП о раскрытии информации продавца к сайту не применяются. Нарушений нет.
ФЗ-149: рекомендательные технологии Готовность: 100%
Нарушения
Не выявлены
Рекомендательные блоки («с этим покупают», «похожие товары» и т.п.) на сайте не обнаружены — требования ст. 10.7 ФЗ-149 к сайту не применяются. Нарушений нет.
ФЗ-38: реклама Готовность: 100%
Нарушения
Не выявлены
Рекламных тематик с обязательными оговорками (медицина, БАД, кредиты и займы, новостройки) на сайте не обнаружено. Нарушений нет.
ФЗ-436: защита детей Готовность: 100%
Нарушения
Не выявлены
Признаков информационной продукции (новости, видео, книги, игры, курсы) не обнаружено — обязательная возрастная маркировка по ФЗ-436 сайту не требуется. Нарушений нет.
Вердикт
Страница https://dwheeler.com/trusting-trust готова к продвижению на 51%. Чтобы еще улучшить страницу и попасть на первые места поисковой выдачи необходимо:
Исправьте ошибки в мета-тегах.
Исправьте ошибки индексации.
Поделитесь с друзьями: