#trustingtrust — Public Fediverse posts

This Week in Security: Claude Gets Hacking, Hotel WiFi, and NPM Compromised Again

https://fed.brid.gy/r/https://hackaday.com/2026/08/07/this-week-in-security-claude-gets-hacking-hotel-wifi-and-npm-compromised-again/

Every year, software development becomes more industrialized.
More packages. More dependencies. More automation.
And, inevitably, more blind trust.
A recent malicious VS Code extension reminded us of something Ken Thompson warned about more than forty years ago:
trusting our tools is unavoidable, but it is also dangerous.
Many organizations still focus on protecting the perimeter while introducing third-party code and dependencies with a level of trust that would be unacceptable anywhere else in their security architecture.
The attacker no longer needs to break the door.
Sometimes all they need is patience.
Anderson understood it in 1972.
Thompson warned us in 1984.
The names changed.
The pattern didn't.
#CyberSecurity #AppSec #SupplyChainSecurity #TrustingTrust

Every year, software development becomes more industrialized.
More packages. More dependencies. More automation.
And, inevitably, more blind trust.
A recent malicious VS Code extension reminded us of something Ken Thompson warned about more than forty years ago:
trusting our tools is unavoidable, but it is also dangerous.
Many organizations still focus on protecting the perimeter while introducing third-party code and dependencies with a level of trust that would be unacceptable anywhere else in their security architecture.
The attacker no longer needs to break the door.
Sometimes all they need is patience.
Anderson understood it in 1972.
Thompson warned us in 1984.
The names changed.
The pattern didn't.
#CyberSecurity #AppSec #SupplyChainSecurity #TrustingTrust

@uutils @fosdem
Yes! The Full-Source Bootstrap, as pioneered by #Guix (https://guix.gnu.org/es/blog/2023/the-full-source-bootstrap-building-from-source-all-the-way-down/), to address the widely ignored #TrustingTrust problem is being ported to/implemented by @nixos_org

It would be amazing to see it in @debian / @ubuntu too and I'm a bit puzzled about what the introduction of Rust might do to what we have accomplished?

@uutils @fosdem
Yes! The Full-Source Bootstrap, as pioneered by #Guix (https://guix.gnu.org/es/blog/2023/the-full-source-bootstrap-building-from-source-all-the-way-down/), to address the widely ignored #TrustingTrust problem is being ported to/implemented by @nixos_org

It would be amazing to see it in @debian / @ubuntu too and I'm a bit puzzled about what the introduction of Rust might do to what we have accomplished?

Interesting tidbit about Rust as used in the Android OS: to prevent the trusting trust attack, and not rely on rust-lang.org build, they bootstrapped rustc 1.19 with mrustc (0.8.0), and then built all following rustc versions with their previous version.

https://cs.android.com/android/platform/superproject/main/+/main:prebuilts/rust/bootstrap/README.md

#RustLang #Android #Toolchains #Bootstrapping #TrustingTrust

Interesting tidbit about Rust as used in the Android OS: to prevent the trusting trust attack, and not rely on rust-lang.org build, they bootstrapped rustc 1.19 with mrustc (0.8.0), and then built all following rustc versions with their previous version.

https://cs.android.com/android/platform/superproject/main/+/main:prebuilts/rust/bootstrap/README.md

#RustLang #Android #Toolchains #Bootstrapping #TrustingTrust

Running the "Reflections on Trusting Trust" Compiler

https://research.swtch.com/nih

#HackerNews #Running #Reflections #on #Trusting #Trust #Compiler #TrustingTrust #CompilerResearch #SoftwareDevelopment #Security

Running the "Reflections on Trusting Trust" Compiler

https://research.swtch.com/nih

#HackerNews #Running #Reflections #on #Trusting #Trust #Compiler #TrustingTrust #CompilerResearch #SoftwareDevelopment #Security

@filippo Meanwhile, bootstrapping a current OpenJDK involves compiling multiple ancient packages (each with its own set of outdated dependencies, of course) and then going up all the way from Java 7, version by version.

@stikonas has described this tedious process and developed some ebuilds for Gentoo here: https://git.stikonas.eu/andrius/gentoo-bootstrap

This also applies to Rust in a way, but at least it's not as bad there – not yet, as the old versions might eventually succumb to bitrot, too.

Please, dear programming language community, can we do better at this? For resilience, for reproducibility, for reliability, for portability and for preservation?

#bootstrappablebuilds #bootstrapping #reproduciblebuilds #trustingtrust #gentoo #openjdk #rust

@filippo Meanwhile, bootstrapping a current OpenJDK involves compiling multiple ancient packages (each with its own set of outdated dependencies, of course) and then going up all the way from Java 7, version by version.

@stikonas has described this tedious process and developed some ebuilds for Gentoo here: https://git.stikonas.eu/andrius/gentoo-bootstrap

This also applies to Rust in a way, but at least it's not as bad there – not yet, as the old versions might eventually succumb to bitrot, too.

Please, dear programming language community, can we do better at this? For resilience, for reproducibility, for reliability, for portability and for preservation?

#bootstrappablebuilds #bootstrapping #reproduciblebuilds #trustingtrust #gentoo #openjdk #rust

Edit: Added &c=my-comment to the URL,
please like my comment, or otherwise help me to reach LaurieWired? Boost=❤️ #askfedi

@regtur @reproducible_builds @guix @ekaitz_zarraga
@nlnet
@fsf
@fsfe
@gnutools
Seems #fedi didn't do their thing just yet, so I logged into the Evil Empire and added a comment. Not sure if that will do any good, tho. I guess maybe one or two of you who read this, and still have a Google account, could like my comment, but there are already comments with > 3K likes, so yeah.

Also, no idea how to reach them; they're talking about trust, and then only seem to on Big Tech platforms like TPPKAB (the platform previously known as birdsite), instagram, etc.

<https://www.youtube.com/watch?v=Fu3laL5VYdM&lc=UgxAf-w-tTYM5syB3x94AaABAg>
#bootstrappablebuilds #guix #gnu #reproducibleBuilds #supplyChainSecurity #trustingTrust

Edit: Added &c=my-comment to the URL,
please like my comment, or otherwise help me to reach LaurieWired? Boost=❤️ #askfedi

@regtur @reproducible_builds @guix @ekaitz_zarraga
@nlnet
@fsf
@fsfe
@gnutools
Seems #fedi didn't do their thing just yet, so I logged into the Evil Empire and added a comment. Not sure if that will do any good, tho. I guess maybe one or two of you who read this, and still have a Google account, could like my comment, but there are already comments with > 3K likes, so yeah.

Also, no idea how to reach them; they're talking about trust, and then only seem to on Big Tech platforms like TPPKAB (the platform previously known as birdsite), instagram, etc.

<https://www.youtube.com/watch?v=Fu3laL5VYdM&lc=UgxAf-w-tTYM5syB3x94AaABAg>
#bootstrappablebuilds #guix #gnu #reproducibleBuilds #supplyChainSecurity #trustingTrust

@regtur
Wait what? #GNU #Mes isn't being mentioned? Not even in the comments?
Fediverse do your thing!

cc: @lauriewired @reproducible_builds
@guix
@ekaitz_zarraga
@nlnet #bootstrappable
#bootstrappablebuilds
#guix
#trustingtrust

@regtur
Wait what? #GNU #Mes isn't being mentioned? Not even in the comments?
Fediverse do your thing!

cc: @lauriewired @reproducible_builds
@guix
@ekaitz_zarraga
@nlnet #bootstrappable
#bootstrappablebuilds
#guix
#trustingtrust