Hacker News new | ask | show | jobs
by mrob 3197 days ago
Multiple implementations of a compiler lets you implement the "Diverse Double-Compiling"[0] countermeasure to the famous "Reflections on Trusting Trust"[1] attack. You wouldn't necessarily use the C++ implementation in production, but it still improves the security of the Rust language just by existing.

[0] https://www.dwheeler.com/trusting-trust/dissertation/html/wh... (previous HN discussion at: https://news.ycombinator.com/item?id=12666923 )

[1] http://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomps...

1 comments

DDC is irrelevant here, DDC is an argument to not write the second compiler in C++ and write it in Rust too.

Having a Rust compiler in C++ is a mitigation to the trusting trust attack, period. You don't need DDC for this.

DDC is necessary when you have two self hosted compilers (e.g. GCC and clang). Here we have one self-hosted compiler (rustc), and one in another language (C++). To mitigate trusting trust in rustc, use mrustc to compile rustc, and then use that rustc to compile itself, and now you have a trusted binary (provided you trust your C++ compiler. you can fix this by DDCing the C++ compilers)