David A. Wheeler

David A. Wheeler, FOSS (and occasionally security) luminary, who also happens to be creator of the popular sloccount tool, has an excellent page that covers this topic and how to use paths safely and portably in shell scripts (spoiler: it's hard) : http://www.dwheeler.com/essays/filenames-in-shell.html I strongly recommend his many other essays to HN readers: http://www.dwheeler.com/ Edit: a simple way to avoid these problems is to prepend the wildcard with ./ (so globbed files won't start with - or -- but with the path ./) and on GNU systems put -- before the wildcard, telling the tool that following arguments are not options.

The best defense against a trusting-trust-attack that I am aware of is Diverse Double-Compilation: https://dwheeler.com/trusting-trust/ It's a simple idea, but can be surprisingly tricky to get exactly the right. Basically, you bootstrap from multiple disconnected and diverse systems and then do pairwise binary comparisons of the bootstrapped program on each of those systems. (This only matters after you've checked the source code itself for Trojans, though)

Formatting doesn’t remove bugs, but it’ll help you detect them. Linted code helps you scan the code faster and provides valuable pattern recognition, allowing us to detect common mistakes. There have been numerous bugs caused by incorrect code formatting, most notably an SSL security bug from 2014: https://dwheeler.com/essays/apple-goto-fail.html Another reason for formatting is the “minimal diff” paradigm. If a formatting rule would not be followed, in the next commit hitting this code, the format would also be affected, causing a larger diff than necessary. There are other reasons for simple format linting, but the reasons above are the most profound. Lastly, formatting is part of a range of static code analysis tools. Generally, formatting inconsistencies are the easiest to detect and resolve, as opposed to more sophisticated tools.

Short answer to mortality: Livit lik sabaka fing to decho. (life sucks and then you die) Catchy, but my attitude to mortality is more optimistic and more resistant to soundbite. Best I can do at the moment, suitable also for our unicellular cousins, is: life is fire, slowed down, with an attitude. https://dwheeler.com/essays/all-men-are-mortal.html Bonus clip: https://www.youtube.com/watch?v=kNnrTNFWcsg

For what it’s worth you can detect a “trusting trust” attack using Diverse Double Compiling. David A. Wheeler implemented it as part of his dissertation back in 2009 and verified that gcc had not been infected. https://dwheeler.com/trusting-trust/

Worth looking at David A. Wheeler’s 2009 work for countering trusting trust attacks: https://dwheeler.com/trusting-trust/

DeWitt clauses (the name for these clauses) have been around since the early 1980s, and have not been struck down yet. I would love to see them disappear, though. For more, see my essay here: https://dwheeler.com/essays/dewitt-clause.html

No kidding. Already, I've found some interesting articles to read. I'm taking a look at https://dwheeler.com/essays/easy-cross-platform-gui.html, which has references to XULRunner etc. which since 2009 have fallen out of favor. Would you continue to recommend those wanting to invest in (for the 80% of use cases) wxWidgets for FLOSS cross-platform GUI apps? BoaConstructor et. al look interesting. Thanks for taking the time to look at this comment. If it helps give you some context, I'll throw in that I currently am most familiar with WinForms .NET apps or very small Win32 native applications, and have avoided JS successfully so far.

Oh, you explaining it is a nice thing to do. I was just showing what was actually necessary to meet the intended goal since that's my field. I learned a lot of the problems from people like Myers who wrote the book on subversion back in 1980. Current approaches still aren't as thorough as what they were doing in the 1970's-1980's. https://csrc.nist.gov/csrc/media/publications/conference-paper/1998/10… If it's about repos, I recommend David A. Wheeler's page on SCM security since following it eliminates most of the risks. https://dwheeler.com/essays/scm-security.html

This was a nice blast from the past! :) Another great resource on 6502 in my opinion have been David Wheelers write-ups on 6502[0]. [0] https://dwheeler.com/6502/ Like I recall he says, I think 6502 was one of the last cpus which assembly was designed for being written by humans (in contrast to modern cpus where all the pipelining and other optimizations make it almost pointless to write most things in assembly). This and other things make it a great platform to learn assembly.

Amazing! Small nitpick: I wanted to see the "hidden message" in The Game of the Century[0], but it says the last move is illegal: Illegal move played?? Rc2# [0]: http://www.dwheeler.com/misc/game_of_the_century.pgn

> not very good for HLL I think it's worth noting that it's very easy to treat the 6502 as having 128 16-bit general purpose registers. If you're okay with poorly optimised code, that makes for a very nice compiler target, while still allowing you to break out to hand-written assembly for inner loops and other sensitive areas. Edit: On rereading, TFA links to https://dwheeler.com/6502/a-lang.txt, where this is approach is discussed under solution 3.

There simply is no good reason. I have had this discussion, and there is a group of people who consider it "unclean" to rule out any characters. There is an excellent discussion of the topic[0]. I find it utterly definitive in the way it relentlessly shows how you can't "fix" this issue completely any other way than by ruling out the bad characters by making the kernel disallow them. [0] https://www.dwheeler.com/essays/fixing-unix-linux-filenames.html

This seems to be the best here. As a side note: if someone does something more complicated and uses piping find output to xargs, there are very important arguments to find and xargs to delimit names with binary zero -- -print0 and -0 respectively. Very interesting article: https://www.dwheeler.com/essays/fixing-unix-linux-filenames.html.

Worth linking "diverse double-compiling" there or to some other resource, if I may make the suggestion. For other interested readers: a) html version of David Wheeler's dissertation: http://www.dwheeler.com/trusting-trust/dissertation/html/wheeler-trust… I read it over a week last month, and it made a big impression on me. b) the HN discussion for the Wheeler dissertation: https://news.ycombinator.com/item?id=12666923

Can we please add a (2009) to the title? This is a classic paper on reproducible builds, everybody is working on since. Better overview: http://www.dwheeler.com/trusting-trust/ Older discussion, 7 years ago: * https://news.ycombinator.com/item?id=1104338

Maybe not favorite but "most memorable": "CVE-2014-6271: Remote code execution through bash" [1] The top comment when I first saw it was, "If you are responsible for the security of any system, this is your immediate, drop-everything priority." [2] Shellshock just kept going, and going, and for days you didn't know what was coming next. I suppose it's unfair to real PTSD victims to say this, but sometimes I feel like I have a little PTSD from that incident. I can only imagine what people at the center of it were going through. My favorite blow-by-blow account was David Wheeler's essay [3] [4]. [1] https://news.ycombinator.com/item?id=8361574 [2] https://news.ycombinator.com/item?id=8361871 [3] http://www.dwheeler.com/essays/shellshock.html [4] https://news.ycombinator.com/item?id=8428644

This. It would be really great to have a language like PowerShell on Linux. Being able to pass file names reliably[0] without disgusting hacks would be great, for a starter. And, unlike in current nix shells, a new shell should separate responsibilities cleanly between tools (`find` has both `-exec` and `-delete` unlike most commands; `grep` has `-c`), return reusable results (damn you `ls`!), have sensible scoping rules, stop on the first error (like `errexit`, `nounset` and `pipefail` implemented sanely), and just generally be more like a real language. [0] http://www.dwheeler.com/essays/filenames-in-shell.html

David A. Wheeler recommends setting IFS=$'\n\t' to handle spaces in filenames & variables. http://www.dwheeler.com/essays/filenames-in-shell.html

Mr. Wheeler is also the person behind the loved and hated sweet-expressions, which provide a way of writing lisp using Python-style indentation [1]. 1. http://www.dwheeler.com/readable/index.html

Excellent article. The quick summary ([1]) is particulary good. Note that quoting variable names is a good idea for other reasons, e.g., when a variable unexpectedly ends up empty: Not quoting such a variable can lead to termination in calls to test ([ ]), e.g., because the empty variable is replace with nothing (so that test sees the next non-whitespace token instead of the expected variable value, empty or otherwise), while quoting will at least cause the shell to correctly replace the variable with an empty string. [1] http://www.dwheeler.com/essays/filenames-in-shell.html#summary

Many people are recommending the '--' option-terminating option. Note David Wheeler's caution (in the essay already linked by AceJohnny2 at https://news.ycombinator.com/item?id=8190208) about why this is not an all-purpose solution: http://www.dwheeler.com/essays/filenames-in-shell.html#dashdash.

There's a dead comment on this from hell-banned user uaygsfdbzf that is quite worthwhile. It's short so I'll just quote it here: "All trusting trust posts made in the past 9 years should also link to David A. Wheeler's Fully Countering Trusting Trust through Diverse Double-Compiling - http://www.dwheeler.com/trusting-trust/dissertation/html/wheeler-trust… (or the poster will be condemned as lazy :-)"

While we're on the subject: other forms of trolling are allowing control characters in filenames, not performing unicode normalization, and allowing filenames to begin with certain shell metacharacters. We must immediately adopt the recommendations in http://www.dwheeler.com/essays/fixing-unix-linux-filenames.html (No, the ability for filenames to contain arbitrary octets is not useful. It never has been.)

I don't know the answer to your question, but it's worth noting that "auditing the binaries" no longer has to mean looking through every line of disassembled byte-code, as was originally thought: http://www.dwheeler.com/trusting-trust

My favorite resource about software innovation is David A. Wheeler's list of the most important software innovations.[1] Most of the items on the list are from the 60s, 70s, and 80s, and 90s; just one is from the past ten years (Wheeler was at first ambivalent about even adding it). He also makes the point that it is okay not to be innovative, and quotes Linus Torvalds: "People want to hear about the one big idea that changes the world, but that’s not how the world works. It’s not about visionary ideas; it’s about lots of good ideas which do not seem world-changing at the time, but which turn out to be great after lots of sweat and work have been applied." [1]http://www.dwheeler.com/innovation/innovation.html

It's unfortunate McNealy failed to immediately raise the obvious benefit of transparency. Open source allows the government and its citizens to more easily verify that mechanisms follow policy and law. This is particularly important for things like voting, surveying, validation and compliance testing where even small faults can cause serious problems and/or compromise the security of the system (e.g. http://www.mail-archive.com/[email protected]/msg00406.html ) David A. Wheeler has a good collection of other reasons here as well: http://www.dwheeler.com/oss_fs_why.html

You can find more on his website - https://dwheeler.com/

>> The cost of Linux kernel development alone has been estimated at a few $B (https://dwheeler.com/essays/linux-kernel-cost.html), current figure is probably over tens of billions. I followed your link, but it doesn't seem to bear out upur assertion. The two numbers mentioned in the article are 176 mil and 612 mil. Mind you those weren't an estimate of cost, but rather an estimate to replace. Article is dated 2004, with an update in 2011. Using the lines-of-code estimation it crossed a billion in 2010 - again to replace. That has no relation to what it did actually cost. Getting from there to "tens of billions" seems a stretch. Assuming a bottom value in your estimate of 20 billion, and assuming a developer costs a million a year, that's 20 000 man-years of effort. Which implies something like 2000 people (very well paid people) working continuously for the last decade. Which seems, well, unlikely.

> Interestingly, there was a lot of speculation and misinformation. So even on Hacker News, this topic is still only vaguely understood. This is not a new revelation, and a similar vulnerability is discussed in Mastering Bitcoin: https://github.com/bitcoinbook/bitcoinbook/blob/develop/ch06.asciidoc#… > The way I understand it, it makes it completely impossible to use Bitcoin in a trustless way. Even with an air gapped hardware wallet, you are always at the mercy of the wallet manufacturer and the delivery chain that gets the wallet to you. If it gets swapped out on the way to you, you are at the mercy of whoever swapped it out. Bitcoin's threat model assumes assumes your client software follows specifications. Airgapped hardware wallets aren't designed to eliminate "Reflections on Trusting Trust". Assuming your scenario, the attack can be tested in a similar way to that outlined in "Fully Countering Trusting Trust through Diverse Double-Compiling" (https://dwheeler.com/trusting-trust/). Under a better defined threat model, a construction can be made to effectively prove any data exfiltration scenario to be false. In conclusion the issue your proposing is not an issue with bitcoin, but with computation in general. The word trustless in the context of cryptocurrencies has slowly been taken out of the context "trusted third parties" and evolved into an epistemological rather than pragmatic issue.