Hacker News new | ask | show | jobs
by Zababa 1780 days ago
Are there any people working seriously on this? I'm aware of efforts for OCaml (http://gallium.inria.fr/~scherer/drafts/camlboot.pdf), but that's it.
3 comments
LukeShu 1780 days ago
https://dwheeler.com/trusting-trust/

'dwheeler is now the Linux Foundation's Director of Open Source Supply Chain Security.

link
pabs3 1780 days ago
The Bootstrappable Builds community (which camlboot is part of) are working on a lot of different efforts in this area. The main one is going from a small amount of machine code to an entire Linux distro, which is in-progress.

https://bootstrappable.org/ https://bootstrapping.miraheze.org/

link
kibwen 1780 days ago
Here's the original resource on Diverse Double Compilation to counter Trusting Trust Attacks: https://dwheeler.com/trusting-trust/

Notably I know the Rust compiler has been verified in this way (or at least certain versions of it have been verified), but it shouldn't be hard to do the same for any language with multiple independent implementations.

link