🚀 go-pugleaf

In article <1991Oct7.134056.17739@turing.ac.uk> mick@quoich.turing.ac.uk (Mick Buckley) writes:

   Our contact within the organization is in favour of g++ and wants
   to use it but he has been prevented from doing so by the `Software
   Police' in his company. Our contact has requested us to write a letter
   to him which somehow supports the integrity of GNU software. He hopes that
   this will persuade the powers-that-be to install g++.

   So, what should I write?
   Is there even some standard blurb which covers the relevant points?

There should be a standard blurb, maybe there is, but I don't know.

What I do recommend to anyone concerned about viruses is that if they
are REALLY concerned, they should have one simple rule:

    NEVER run binaries provided on the disks, but ALWAYS rebuild the
    product from scratch from its source code, after skimming all the
    source code looking for anything "suspicious".

It is far easier to inspect the source code of a program for possible
viruses than to inspect object or executable files.  Furthermore, it is
far more difficult for a virus to attach itself to source code than to
object or executable code.

Note, however, that few vendors, aside from the Free Software Foundation,
provide complete source code at no extra charge.

Purchasing and using most commercial proprietary (non-source-included)
software, worrying about computer viruses, and therefore avoiding
GNU software, is roughly the same as being a homeless heroine addict finding
syringes and needles in the trash, worrying about AIDS, and therefore
avoiding your social worker because you think he or she might be gay.

This is not to say it is impossible for viruses to be written that manage
to lurk in GNU software at the source level and replicate themselves --
just that it is at least several orders of magnitude harder than the
trivial binary-code viruses we have on PC-compatibles, Macintoshes, and
the like, and therefore far less likely to happen (and probably easier to
eradicate once detected).

Also, I'm not saying the GNU software has inherently more "integrity"
at the executable level than other software.  However, because it is
published at the source level, and because that source is read and
modified by many different people at many different sites, it is unlikely
that one person or group would be capable of insinuating a virus or
viral replicator (a bit of code that detects certain patterns in a
program being compiled by, say, g++ and replaces them with viruses)
without that effort being detected by someone else on the project before
release.  I am saying that software released at the source level does
inherently have more integrity than software released at the executable
or object level, because the primary purpose of not releasing source is
to prevent customers from learning how a product works -- which has a
side effect of preventing customers from discovering whether the product
has been infected by a virus.

If I had to stake my career on keeping a system or a small network of
systems entirely virus-free, I'd start by trashing any program for which
I couldn't obtain source code readily, then rebuild every single program
from the source after perusing it looking for possible suspicious virus-
like activities in the source (admittedly this requires some experience
with doing this sort of thing, but any reasonably experienced programmer
should be capable of doing an adequate job).  I'd never let anyone
put "executables" of any form onto the system, they'd have to create them
from source that I'd look at first.  And, of course, this means I'd have
already looked at the source to whatever program translated the source
(including assemblers, compilers, database languages, and so on) to make
sure there weren't "holes" waiting to be exploited.  (There are many
other things I'd have to do, but without these initial steps, they'd be
wastes of time, IMHO.)  Naturally, this all means there would be some
applications we couldn't run because no source were (feasibly) obtainable,
but that's life, and that's why Project GNU is a Good Thing and should be
more widely supported than it already is.

This kind of thing will be much easier for your average UNIX site once
the GNU project is complete, because operating systems often are excellent
targets for exploitation by viruses.  With GNU Unix, one will have the
source available to analyze.  I get the impression that isn't generally
true of many UNIX OS implementations.
--

James Craig Burley, Software Craftsperson    burley@gnu.ai.mit.edu