[117061] in Cypherpunks
Re: PGP source and binaries comparisons, and vain and degrading
daemon@ATHENA.MIT.EDU (Petro)
Wed Aug 25 19:59:14 1999
Mime-Version: 1.0
Message-Id: <v04205506b3ea2f32512b@[216.112.5.39]>
In-Reply-To: <199908251809.OAA22679@cti06.citenet.net>
Date: Wed, 25 Aug 1999 16:45:30 -0700
To: cypherpunks@cyberpass.net
From: Petro <petro@suba.com>
Content-Type: text/plain; charset="iso-8859-1" ; format="flowed"
Content-Transfer-Encoding: 8bit
Reply-To: Petro <petro@suba.com>
>On Tue, 24 Aug 1999 23:44:02 -0500, Sean Roach wrote:
>>At 07:05 PM 8/24/99 -0400, Jean-Francois Avon wrote:
>>>As a side question:
>>>Did anybody check if the actual PGP binaries distribution is
>>>identical to what
>>>you obtain upon compilation of the published source?
>
>
>>Would it be? What if I used a different compiler? What if I didn't have
>>optimization turned on? What if I didn't have it turned off? What if it
>>recognized that I had a pentium and not just a 386?
>
>I wonder why the vain idiot who replied doesn't compile the code on the good
>processor, with optimization in the proper state, etc, etc? He seems to have
>forgotten that there are way many more ways to fail than to succeed,
>to be dead
>than alive...
>
>All is needed is that _some_ trustworthy people do it and obtain the proper
>results. The vast majority of PGP users don't only not own any compiler, they
>don't even know what it is! So, they rely on the integrity of
>others. In that
>case, the integrity of Cypherpunks and the grass-root crypto
>community. Just as
>most Cypherpunks rely on the integrity of some others for knowledge.
>Otherwise,
>everybody would have to learn medicine and rocket science and everything for
>himself!
>
>I really do LOVE out-of-context and genuinely going-out-of-their-way-to-be-
>supremely-nitpicking-asshole replies like that!
His point, you Boob, is that any one of the constraints he
mentions can change the binary enough to be different.
Smart compilers can optimize code for a specific processor
(3/4/5/686), as well there are a host of different optimizations one
can ask of the compiler, and a bunch of link time stuff as well--if
the libraries you are linking to are slightly different--caused by
the same things in compiling them--and you are statically linking the
binaries, you will get different results.
There is also a difference between compilers, and versions of
compilers--gcc 2.7.2, 2.8.1, egcs 1.1.2 and gcc 2.95 will all output
different object code GIVEN EXACTLY THE SAME INPUT.
This makes verifying the binaries a SERIOUSLY non-trivial
task, and makes comparing them utterly useless without going thru
them byte by byte, and then you STILL may miss a clever compromise.
For fucks sake man, at least have a CLUE before you put your
foot in your mouth.
--
"To sum up: The entire structure of antitrust statutes in this
country is a jumble of economic irrationality and ignorance. It is a
product: (a) of a gross misinterpretation of history, and (b) of
rather naïve, and certainly unrealistic, economic theories." Alan
Greenspan, "Anti-trust"
http://www.ecosystems.net/mgering/antitrust.html
