"Rust is self-hosting: To build a new rustc, you need an existing rustc binary (usually the previous stable release). This creates a chain of trust that goes back to the very first bootstrap (historically from OCaml, but modern versions rely on prior Rust binaries).
If any link in that historical chain was ever compromised the backdoor can live on indefinitely.
Unlike C/C++ (which has diverse independent compilers like GCC, Clang, MSVC), Rust has essentially one production compiler (rustc). This makes diverse double-compilation (DDC), the main defense, much harder. DDC involves compiling the compiler source with multiple independent compilers and checking that the outputs match (proving the binary corresponds to the source). With only one mature compiler, you can't easily cross-verify.
There have been public demonstrations of exactly this kind of attack working on Rust (e.g., Manish Goregaokar's "Reflections on Rusting Trust" in 2016."
Lunduke is not a programmer, he's a tech influencer. If he cannot point to the part of the Open Source program that is backdoored, it's probably another one of his meaningless ragebait pieces.
Suffice to say that Lunduke is technology's "Boy who cried Wolf" concerning security research.
I’m struggling to understand why the German government is looking to compromise archlinux - arguably a niche of niches that is unlikely to be used by any of their enemies/targets.
vaylian|1 month ago
Arch Linux's package management is only one out of many open source projects that are being financially supported.
I think the tweet is just FUD (Fear, Uncertainty and Doubt)
DonnyV|1 month ago
If any link in that historical chain was ever compromised the backdoor can live on indefinitely.
Unlike C/C++ (which has diverse independent compilers like GCC, Clang, MSVC), Rust has essentially one production compiler (rustc). This makes diverse double-compilation (DDC), the main defense, much harder. DDC involves compiling the compiler source with multiple independent compilers and checking that the outputs match (proving the binary corresponds to the source). With only one mature compiler, you can't easily cross-verify.
There have been public demonstrations of exactly this kind of attack working on Rust (e.g., Manish Goregaokar's "Reflections on Rusting Trust" in 2016."
https://x.com/lmilsfsd/status/2011920950070046787
hyperman1|1 month ago
https://github.com/thepowersgang/mrustc
bigyabai|1 month ago
Suffice to say that Lunduke is technology's "Boy who cried Wolf" concerning security research.
adityamwagh|1 month ago
yunohn|1 month ago
7bit|1 month ago
> There's no way you're this retarded