On Tue, Jul 05, 2016 at 07:24:38PM +0200, Quentin Rameau wrote:
> > So let's consider 3 situations.
> > 1-- Compile scc with Java EE 7. Use the output WASM blob to compile scc. Get B1
> > 2-- Compile scc with tcc. Use the output WASM blob to compile scc. Get B2
> > 3-- Compile scc with clang. Use the output WASM blob to compile scc. Get
> > B3
> >
> > Are you saying that if we compare the md5 of B1, B2 and B3 they will
> > be identical?
> Well, that could depend on how high are solar winds that day (apart
> from that, they should be, yes).
Try it out: you are mistaken here. Just use a simplistic hello world and you
will see that at most Java EE 7 and clang don't generate the same WASM blob (if
compared with some kind of bindiff you'll see that they are not even
close) - I just tried it myself.
But compiling a compiler with different compilers and compare the
binaries each version generates is a way to make sure that no (possibly)
malicous) function is injected (see [1] - a paper about a way to counter
the attack desribed in "Reflections on Trusting Trust" which itself is a
good read, too).
WKR
Hinnerk
[1]
https://www.acsa-admin.org/2005/abstracts/47.html
Received on Tue Jul 05 2016 - 20:11:51 CEST