Post #3971999
2026-07-20 21:49 UTC
there's a hypothetical compiler exploit that i always thought was a bit out there but it was a big deal with some folks, and i haven't heard anyone talk about it in a hot minute. the gist is, you make a custom version of clang or whatever that adds a payload into what it builds (presumably not everything or it would be easy to track down) including itself such that it is self-perpetuating, and then you somehow trick the clang maintainers into shipping that instead of a real release build etc
Replies (1)
-
@aeva@mastodon.gamedev.place 2026-07-20 21:54
anyways the attack boils down to there being part of your program or the program that makes your program that you are not able or willing to read (eg nobody's got time to disassemble clang, and how do you know your disassembler isn't in on it too) I just think it's funny because the slopists don't even need a compiler to create those pockets once they give up trying to review anything