Re: [Mono-list] Re: Bootstrapping
Hi, Brandon Knitter <[EMAIL PROTECTED]> writes: >> The VERY first C compiler was probably written in Assembly, or Pascal, or >> something... If we were really paranoid, we'd keep the source for that >> around. And the PDP/8 it ran on ;-) (Brian Kernighan has a great speech on >> this topic, btw: http://www.acm.org/classics/sep95/) > > I'm not paranoid, I'm trying to understand *exactly* how Mono was written. > Although, if it was written in Assembly I'm going to run in fear! ;-) > >> Mono, the runtime wasn't written in C#, was it? If so, is it reasonable >> to expect to boot-strap mono something like this? >> >> 1) build MCS using .NET on Windows >> 2) build the runtime >> 3) use the output of 2) to run the output of 1) to self-compile > > Yeah, that would be fine. I can't download blackbox binary to compile Mono and > do a full security review. I'd like to see more core of core, and build it from > there. So, you're willing to download a blackbox compiler from Microsoft ??? - Hari ___ Mono-list maillist - [EMAIL PROTECTED] http://lists.ximian.com/mailman/listinfo/mono-list
Re: [Mono-list] Re: Bootstrapping
At 04:47 PM 13/07/2004 +0200, Norbert Bollow nb-at-SoftwareEconomics.biz |mono-list subscript wrote: >Todd Berman <[EMAIL PROTECTED]> wrote: >> Just out of curiosity, who the hell cares? >> >> Neither one is trojaned. Lets just move on. > >I have decided to honor your request and "move on", i.e. this >is going to be my last posting in this thread. > >However, I'd like you to understand why at least from my >perspective this is not a satisfactory resolution: > >I believe that many people will agree with me when I say that >it is evil monopolistic bahavior when Microsoft spreads FUD >against GNU/Linux, the GPL, and the open source movement. > >Now Novell apparantly also has a policy of spreading FUD, namely >against a GNU project that their Mono project happens to >compete with. That is essentially the same kind of behavior. > >Novell should stop this behavior and issue an official, public >apology which covers both this and their previous FUD attacks. There is no FUD here. You have a history of paranoia and friction with the Mono project and its managers. Never did Miguel actually suggest that either project was trojaned. He merely stated the possibility, and you immediately and emphatically denied even that possibility. However, anyone with a basic understanding of security and compiler technology can see that it IS possible. It is possible, but it hasn't actually been done. All that Miguel said was "no project is immune to tampering, hacking and trojan horses." I do not expect you to answer this message, because, as you said, this is your last posting in this thread. Just, please understand that posts like the one you have made here do not serve any purpose, except to annoy all other people on this list, contributors or not, including those (and I'm sure they exist) who are involved with DotGNU/Portable.NET. Please stop fighting with us and get on with developing your project. Jonathan ___ Mono-list maillist - [EMAIL PROTECTED] http://lists.ximian.com/mailman/listinfo/mono-list
Re: [Mono-list] Re: Bootstrapping
At 04:47 PM 13/07/2004 +0200, Norbert Bollow nb-at-SoftwareEconomics.biz |mono-list subscript wrote: >Todd Berman <[EMAIL PROTECTED]> wrote: >> Just out of curiosity, who the hell cares? >> >> Neither one is trojaned. Lets just move on. > >I have decided to honor your request and "move on", i.e. this >is going to be my last posting in this thread. > >However, I'd like you to understand why at least from my >perspective this is not a satisfactory resolution: > >I believe that many people will agree with me when I say that >it is evil monopolistic bahavior when Microsoft spreads FUD >against GNU/Linux, the GPL, and the open source movement. > >Now Novell apparantly also has a policy of spreading FUD, namely >against a GNU project that their Mono project happens to >compete with. That is essentially the same kind of behavior. > >Novell should stop this behavior and issue an official, public >apology which covers both this and their previous FUD attacks. There is no FUD here. You have a history of paranoia and friction with the Mono project and its managers. Never did Miguel actually suggest that either project was trojaned. He merely stated the possibility, and you immediately and emphatically denied even that possibility. However, anyone with a basic understanding of security and compiler technology can see that it IS possible. It is possible, but it hasn't actually been done. All that Miguel said was "no project is immune to tampering, hacking and trojan horses." I do not expect you to answer this message, because, as you said, this is your last posting in this thread. Just, please understand that posts like the one you have made here do not serve any purpose, except to annoy all other people on this list, contributors or not, including those (and I'm sure they exist) who are involved with DotGNU/Portable.NET. Please stop fighting with us and get on with developing your project. Jonathan ___ Mono-list maillist - [EMAIL PROTECTED] http://lists.ximian.com/mailman/listinfo/mono-list
Re: [Mono-list] Re: Bootstrapping
Hello, > Now Novell apparantly also has a policy of spreading FUD, namely > against a GNU project that their Mono project happens to > compete with. That is essentially the same kind of behavior. > > Novell should stop this behavior and issue an official, public > apology which covers both this and their previous FUD attacks. I can officially state that there is no such policy in place. People disagree violently over mailing lists, big deal. Miguel. ___ Mono-list maillist - [EMAIL PROTECTED] http://lists.ximian.com/mailman/listinfo/mono-list
Re: [Mono-list] Re: Bootstrapping
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Todd Berman <[EMAIL PROTECTED]> wrote: > Just out of curiosity, who the hell cares? > > Neither one is trojaned. Lets just move on. I have decided to honor your request and "move on", i.e. this is going to be my last posting in this thread. However, I'd like you to understand why at least from my perspective this is not a satisfactory resolution: I believe that many people will agree with me when I say that it is evil monopolistic bahavior when Microsoft spreads FUD against GNU/Linux, the GPL, and the open source movement. Now Novell apparantly also has a policy of spreading FUD, namely against a GNU project that their Mono project happens to compete with. That is essentially the same kind of behavior. Novell should stop this behavior and issue an official, public apology which covers both this and their previous FUD attacks. Greetings, Norbert. - -- Founder & Steering Committee member of DotGNU, see http://dotgnu.org/ Free Software Business Strategy Guide ---> http://FreeStrategy.info Norbert Bollow, Weidlistr.18, CH-8624 Gruet (near Zurich, Switzerland) Tel +41 1 972 20 59Fax +41 1 972 20 69 http://norbert.ch -BEGIN PGP SIGNATURE- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFA8/TKoYIVvXUl7DIRAjjiAJ40/M3iH57N5FwkLxelRCk4Y+H5QgCgxc1q liVbMOYJbEP/LmPvhf1w1t8= =eKBY -END PGP SIGNATURE- ___ Mono-list maillist - [EMAIL PROTECTED] http://lists.ximian.com/mailman/listinfo/mono-list
Re: [Mono-list] Re: Bootstrapping
On Mon, 2004-07-12 at 16:17 +0200, Norbert Bollow wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Paolo Molaro <[EMAIL PROTECTED]> wrote: > > > > Is this an attempt to spread FUD (Fear, Uncertainty and Doubt) about > > > the DotGNU Portable.Net (pnet) system, or did you honestly write the > > > above without thinking about the matter first? > > > > It's not FUD, it's just the reality: if people think that using pnet is > > safer wrt a possible trojan injected by MS, they are deluding > > themselves (and showing they don't know much about security). > > You claimed that MS had more opportunity to inject a trojan into > our system than they had for injecting a trojan into yours, thereby > implying that that would have been possible for them. Since the kind > of attack which was under discussion is possible only with compilers > which are used to compile themselves (which is the case with mono's > compiler but not with the DotGNU Portable.Net system), the statement > which you made is FUD and you owe us an apology for it. > > > Unless the C compiler (for example) was trojaned by the Console.WriteLine() > > implementation (emitted by the hyphotetical trojaning MS compiler) when > > the first tests were run with pnet. So the moment you ran untrusted code > > on the system, it doesn't matter if you bootstrap from C or from C#. > > Even more FUD. Even if (as you seem to imply) a hypothetical > trojaning MS compiler had trojaned early pnetlib builds in a way which > exploits some kernel security hole on GNU/Linux systems to gain root > privileges to modify the C compiler installation on that machine, that > would not have affected the binaries which we distribute today because > they're built on other machines which have probably never received > _any_ binaries from the machines where the early tests were done. (If > in your opinion the "probably" above isn't good enough, let me know; I > can easily enough do a round of builds on machines where I can guarantee > this to be the case.) > > > Just as a summary, since people seem to be sensitive about these issues: > > *) I don't think MS has trojaned either mono or pnet > > *) if they could have trojaned mono, they could have done the same to pnet > > *) since the trojaning of both systems is theoretical it's not easy to > > say which one of the two could be more likely, but feel free to discuss > > it in the [EMAIL PROTECTED] list:-) > > I do think that the (at least theoretical) possibility of trojaned > self-compiling compilers should be on the "long list of potential > issues to take into consideration". I do not think that it is > appropriate to single out MS as the only potential attacker. > > I believe that good security can be achieved only by taking into > consideration all possible attacks from all possible attackers. Is > the Mono project leadership in disagreement with this view? > > Greetings, Norbert. > > - -- > Founder & Steering Committee member of DotGNU, see http://dotgnu.org/ > Free Software Business Strategy Guide ---> http://FreeStrategy.info > Norbert Bollow, Weidlistr.18, CH-8624 Gruet (near Zurich, Switzerland) > Tel +41 1 972 20 59Fax +41 1 972 20 69 http://norbert.ch > -BEGIN PGP SIGNATURE- > Version: GnuPG v1.2.4 (GNU/Linux) > > iD8DBQFA8p0uoYIVvXUl7DIRAtyCAKDVHhHRr2zfqivIoejt1JWSWoVf4ACgsNEB > I2A4ZMmPczZ9bexxWGvw8sM= > =0Kuz > -END PGP SIGNATURE- Just out of curiosity, who the hell cares? Neither one is trojaned. Lets just move on. --Todd ___ Mono-list maillist - [EMAIL PROTECTED] http://lists.ximian.com/mailman/listinfo/mono-list
Re: [Mono-list] Re: Bootstrapping
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Jon Watte <[EMAIL PROTECTED]> wrote: > I believe that all three of these criteria will push this risk > to the bottom of the pile WRT mono task lists. That sounds reasonable; also I wouldn't object when someone says that there's nothing wrong with putting it on a "risks that we choose not to address" list. My objection was against a -clearly false- FUD statement of a Mono project leader about DotGNU having risks in this area. Also I would like to know what exactly the position of the Mono project leadership is concerning what security threats should be taken into consideration, so that I can make sure that I won't accidentally misrepresent their position. > But if you feel different, I think there's room to contribute ;-) I do feel different but I have been at the receiving end of so much hostility from Mono project leaders that now I'm very sure that I'm not interested in contributing to Mono, at least as long as these people are leading. Greetings, Norbert. - -- Founder & Steering Committee member of DotGNU, see http://dotgnu.org/ Free Software Business Strategy Guide ---> http://FreeStrategy.info Norbert Bollow, Weidlistr.18, CH-8624 Gruet (near Zurich, Switzerland) Tel +41 1 972 20 59Fax +41 1 972 20 69 http://norbert.ch -BEGIN PGP SIGNATURE- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFA8sE4oYIVvXUl7DIRAj7CAJ9dRyG9WBL8LKn2AqVbQNFncDQ7ZACg3tcC PxBMFirDbxAx/T5U79NTX28= =gLER -END PGP SIGNATURE- ___ Mono-list maillist - [EMAIL PROTECTED] http://lists.ximian.com/mailman/listinfo/mono-list
RE: [Mono-list] Re: Bootstrapping
> I believe that good security can be achieved only by taking into > consideration all possible attacks from all possible attackers. Is > the Mono project leadership in disagreement with this view? Good risk management will allocate resources to possible attacks in proportion to: - their assumed chance of occuring - the assumed extent of the damage of such an attack - the leverage which can be achieved against such an attack For example: If there's a chance of the NSA having a crack for RSA crypto, and all your secrets will be known by the government, but you just have no way of figuring out how to build a new cryptosystem, then you probably are still doing the risk analysis that RSA is good enough. I believe that all three of these criteria will push this risk to the bottom of the pile WRT mono task lists. But if you feel different, I think there's room to contribute ;-) Cheers, / h+ ___ Mono-list maillist - [EMAIL PROTECTED] http://lists.ximian.com/mailman/listinfo/mono-list
Re: [Mono-list] Re: Bootstrapping
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Paolo Molaro <[EMAIL PROTECTED]> wrote: > > Is this an attempt to spread FUD (Fear, Uncertainty and Doubt) about > > the DotGNU Portable.Net (pnet) system, or did you honestly write the > > above without thinking about the matter first? > > It's not FUD, it's just the reality: if people think that using pnet is > safer wrt a possible trojan injected by MS, they are deluding > themselves (and showing they don't know much about security). You claimed that MS had more opportunity to inject a trojan into our system than they had for injecting a trojan into yours, thereby implying that that would have been possible for them. Since the kind of attack which was under discussion is possible only with compilers which are used to compile themselves (which is the case with mono's compiler but not with the DotGNU Portable.Net system), the statement which you made is FUD and you owe us an apology for it. > Unless the C compiler (for example) was trojaned by the Console.WriteLine() > implementation (emitted by the hyphotetical trojaning MS compiler) when > the first tests were run with pnet. So the moment you ran untrusted code > on the system, it doesn't matter if you bootstrap from C or from C#. Even more FUD. Even if (as you seem to imply) a hypothetical trojaning MS compiler had trojaned early pnetlib builds in a way which exploits some kernel security hole on GNU/Linux systems to gain root privileges to modify the C compiler installation on that machine, that would not have affected the binaries which we distribute today because they're built on other machines which have probably never received _any_ binaries from the machines where the early tests were done. (If in your opinion the "probably" above isn't good enough, let me know; I can easily enough do a round of builds on machines where I can guarantee this to be the case.) > Just as a summary, since people seem to be sensitive about these issues: > *) I don't think MS has trojaned either mono or pnet > *) if they could have trojaned mono, they could have done the same to pnet > *) since the trojaning of both systems is theoretical it's not easy to > say which one of the two could be more likely, but feel free to discuss > it in the [EMAIL PROTECTED] list:-) I do think that the (at least theoretical) possibility of trojaned self-compiling compilers should be on the "long list of potential issues to take into consideration". I do not think that it is appropriate to single out MS as the only potential attacker. I believe that good security can be achieved only by taking into consideration all possible attacks from all possible attackers. Is the Mono project leadership in disagreement with this view? Greetings, Norbert. - -- Founder & Steering Committee member of DotGNU, see http://dotgnu.org/ Free Software Business Strategy Guide ---> http://FreeStrategy.info Norbert Bollow, Weidlistr.18, CH-8624 Gruet (near Zurich, Switzerland) Tel +41 1 972 20 59Fax +41 1 972 20 69 http://norbert.ch -BEGIN PGP SIGNATURE- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFA8p0uoYIVvXUl7DIRAtyCAKDVHhHRr2zfqivIoejt1JWSWoVf4ACgsNEB I2A4ZMmPczZ9bexxWGvw8sM= =0Kuz -END PGP SIGNATURE- ___ Mono-list maillist - [EMAIL PROTECTED] http://lists.ximian.com/mailman/listinfo/mono-list
Re: [Mono-list] Re: Bootstrapping
On 07/08/04 Norbert Bollow wrote: > > Originally mcs and corlib where compiled with csc on windows, so > > paranoid people suppose MS could have injected a trojan. Assuming pnet's > > compiler could compile mcs and corlib correctly, would that give any > > more guarantees? Nope, since thay had to use the MS compiler to build > > their own corlib for much longer than us, the window of opportunity for > > the evil MS to inject a trojan on their system was much bigger, so there > > is no additional guarantee and people are deluding themselves if they > > think there is. > > Is this an attempt to spread FUD (Fear, Uncertainty and Doubt) about > the DotGNU Portable.Net (pnet) system, or did you honestly write the > above without thinking about the matter first? It's not FUD, it's just the reality: if people think that using pnet is safer wrt a possible trojan injected by MS, they are deluding themselves (and showing they don't know much about security). > There is no possibility whatsoever that Microsoft could have injected > a trojan into the DotGNU Portable.Net (pnet) system, since building > pnet does not require already having a C# compiler or a "corlib". This doesn't matter, see below: the problem is that the systems where pnet were built (just as mono) ran untrusted code compiled by the MS csc. On 07/09/04 Thong (Tum) Nguyen wrote: > Quite incorrect. Building pnet's corlib doesn't require an existing corlib > because PNET's compiler (like MS's compiler) is written in C. Even if pnet > used a trojan compiler to compile corlib at one point or another, any > subsequent recompilation with cscc would overwrite the trojan. Unless the C compiler (for example) was trojaned by the Console.WriteLine() implementation (emitted by the hyphotetical trojaning MS compiler) when the first tests were run with pnet. So the moment you ran untrusted code on the system, it doesn't matter if you bootstrap from C or from C#. Just as a summary, since people seem to be sensitive about these issues: *) I don't think MS has trojaned either mono or pnet *) if they could have trojaned mono, they could have done the same to pnet *) since the trojaning of both systems is theoretical it's not easy to say which one of the two could be more likely, but feel free to discuss it in the [EMAIL PROTECTED] list:-) lupus -- - [EMAIL PROTECTED] debian/rules [EMAIL PROTECTED] Monkeys do it better ___ Mono-list maillist - [EMAIL PROTECTED] http://lists.ximian.com/mailman/listinfo/mono-list
RE: [Mono-list] Re: Bootstrapping
> -Original Message- > From: [EMAIL PROTECTED] [mailto:mono-list- > [EMAIL PROTECTED] On Behalf Of Paolo Molaro > Sent: Friday, 9 July 2004 02:05 > To: [EMAIL PROTECTED] > Subject: Re: [Mono-list] Re: Bootstrapping > > On 07/08/04 Jonathan Pryor wrote: > > Besides, between the Mono and PNET projects we've effectively done the > > dual compiler scenario. For a full "from source" bootstrap you'd just > > need to get PNET's compiler to be able to process the Mono class > > libraries. This may already be possible, but I haven't tried it. > > There is no full "from source" bootstrap, since you have to start > trusting something somewhere (are you sure your video card shows you the > correct stuff? Is the firmware in your hard-drive trustworthy?). > Originally mcs and corlib where compiled with csc on windows, so > paranoid people suppose MS could have injected a trojan. Assuming pnet's > compiler could compile mcs and corlib correctly, would that give any > more guarantees? Nope, since thay had to use the MS compiler to build > their own corlib for much longer than us, the window of opportunity for > the evil MS to inject a trojan on their system was much bigger, so there > is no additional guarantee and people are deluding themselves if they > think there is. An attack on the original mcs binary would have been > very sophitsticated, still someone thinks it would be possible to detect > such an attack by ignoring an equivalently-sophisticated attack. > Quite incorrect. Building pnet's corlib doesn't require an existing corlib because PNET's compiler (like MS's compiler) is written in C. Even if pnet used a trojan compiler to compile corlib at one point or another, any subsequent recompilation with cscc would overwrite the trojan. Regards, ^Tum ___ Mono-list maillist - [EMAIL PROTECTED] http://lists.ximian.com/mailman/listinfo/mono-list
RE: [Mono-list] Re: Bootstrapping
Hey all, > There is no possibility whatsoever that Microsoft could have injected > a trojan into the DotGNU Portable.Net (pnet) system, since building > pnet does not require already having a C# compiler or a "corlib". Maybe Intel and AMD put a Trojan in it's proc, so I wouldn't be touching a pc! Why the heck does it matter if MS inserted a Trojan... there's nothing in it for them, only a downside when they get caught... There's enough of this paranoid crap in the mailinglist, you could read that instead of starting again... Greetz, -- Rob. ___ Mono-list maillist - [EMAIL PROTECTED] http://lists.ximian.com/mailman/listinfo/mono-list
Re: [Mono-list] Re: Bootstrapping
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Paolo Molaro <[EMAIL PROTECTED]> wrote: > Originally mcs and corlib where compiled with csc on windows, so > paranoid people suppose MS could have injected a trojan. Assuming pnet's > compiler could compile mcs and corlib correctly, would that give any > more guarantees? Nope, since thay had to use the MS compiler to build > their own corlib for much longer than us, the window of opportunity for > the evil MS to inject a trojan on their system was much bigger, so there > is no additional guarantee and people are deluding themselves if they > think there is. Is this an attempt to spread FUD (Fear, Uncertainty and Doubt) about the DotGNU Portable.Net (pnet) system, or did you honestly write the above without thinking about the matter first? There is no possibility whatsoever that Microsoft could have injected a trojan into the DotGNU Portable.Net (pnet) system, since building pnet does not require already having a C# compiler or a "corlib". Greetings, Norbert. - -- Founder & Steering Committee member of DotGNU, see http://dotgnu.org/ Free Software Business Strategy Guide ---> http://FreeStrategy.info Norbert Bollow, Weidlistr.18, CH-8624 Gruet (near Zurich, Switzerland) Tel +41 1 972 20 59Fax +41 1 972 20 69 http://norbert.ch -BEGIN PGP SIGNATURE- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFA7YMXoYIVvXUl7DIRAtxnAJ49TuS7LtgLPv77+wyWmvyMamSCAwCglDF7 W0GN47GL6Mr8hPH4E6M6mxw= =UsNz -END PGP SIGNATURE- ___ Mono-list maillist - [EMAIL PROTECTED] http://lists.ximian.com/mailman/listinfo/mono-list
Re: [Mono-list] Re: Bootstrapping
> If the original Mono mcs C# compiler was written and compiled on a Windows > machine, how did it get ported to Linux? Was there some sort of wine or > wine-ish runtime used to execute csc on Linux to compile the first mcs? I guess this explains your confusion. The code generated in the .NET world is not native x86 code, it is an intermediate language called CIL which works across many platforms (provided you have a VM to run it). See Paolo's post for more details. But basically the same .exe can be used on Windows and Linux as long as the compiler is concerned. Miguel ___ Mono-list maillist - [EMAIL PROTECTED] http://lists.ximian.com/mailman/listinfo/mono-list
Re: [Mono-list] Re: Bootstrapping
Hello, > So then you ask: why write the C# compiler in C#? Elegance, to better > learn the C# language, and most importantly, because it's not C. ;-) Elegance is also key when it comes to maintaining the code: being able to fix bugs, using high-level constructs, being able to model new ideas quickly, be able to `read' the code more easily. Miguel ___ Mono-list maillist - [EMAIL PROTECTED] http://lists.ximian.com/mailman/listinfo/mono-list
Re: [Mono-list] Re: Bootstrapping
On 07/08/04 Brandon Knitter wrote: > If the original Mono mcs C# compiler was written and compiled on a Windows > machine, how did it get ported to Linux? Was there some sort of wine or > wine-ish runtime used to execute csc on Linux to compile the first mcs? The first mcs.exe and corlib.dll binaries were compiled on windows. While mcs and corlib were being worked on, work was done on linux to build the CLI runtime that could execute the IL code in mcs and corlib (at first just as an interpreter, later as a JIT compiler). The interpreter/JIT and support libraies are written in C. Using the binaries compiled on windows a new corlib and a new mcs were compiled (on linux this time) and they have been used to compile new versions of mcs and corlib since then (with each new version used to compile the next). > Also, how does this initial bootstrapping binary play out for other platforms? > When porting to each target platform, will a similar bootstrapping binary have > to be compiled so that the larger mcs compiler can be built? Who's going to > maintain those? There is no larger mcs. The same process above works for any platform mono works on (except no one uses the windows builds anymore, but we start from a mcs and corlib binaries built on linux/x86). lupus -- - [EMAIL PROTECTED] debian/rules [EMAIL PROTECTED] Monkeys do it better ___ Mono-list maillist - [EMAIL PROTECTED] http://lists.ximian.com/mailman/listinfo/mono-list
Re: [Mono-list] Re: Bootstrapping
> The Microsoft csc C# compiler is written in C++, so there are no > bootstrapping issues. > > Mono's mcs C# compiler was written in C#, and originally compiled with > csc. So csc was the original bootstrap compiler, but now a previous > version of the C# compiler is used. For example, the Mono 0.97 compiler > could be used to compile the Mono 1.0 compiler. If the original Mono mcs C# compiler was written and compiled on a Windows machine, how did it get ported to Linux? Was there some sort of wine or wine-ish runtime used to execute csc on Linux to compile the first mcs? Also, how does this initial bootstrapping binary play out for other platforms? When porting to each target platform, will a similar bootstrapping binary have to be compiled so that the larger mcs compiler can be built? Who's going to maintain those? Thanks, -- -bk ___ Mono-list maillist - [EMAIL PROTECTED] http://lists.ximian.com/mailman/listinfo/mono-list
Re: [Mono-list] Re: Bootstrapping
> There is no full "from source" bootstrap, since you have to start > trusting something somewhere Sorry for the confusion. I don't think bootstraping from the ground up is really a trust issue. It's more of an understanding issue. Most exploits aren't done out of malace, but done out of error. I'm not saying I don't trust things, I just want to understand the nuts and bolts. If I wanted to blindly trust Mono, I already do. -- -bk ___ Mono-list maillist - [EMAIL PROTECTED] http://lists.ximian.com/mailman/listinfo/mono-list
Re: [Mono-list] Re: Bootstrapping
On 07/08/04 Jonathan Pryor wrote: > Besides, between the Mono and PNET projects we've effectively done the > dual compiler scenario. For a full "from source" bootstrap you'd just > need to get PNET's compiler to be able to process the Mono class > libraries. This may already be possible, but I haven't tried it. There is no full "from source" bootstrap, since you have to start trusting something somewhere (are you sure your video card shows you the correct stuff? Is the firmware in your hard-drive trustworthy?). Originally mcs and corlib where compiled with csc on windows, so paranoid people suppose MS could have injected a trojan. Assuming pnet's compiler could compile mcs and corlib correctly, would that give any more guarantees? Nope, since thay had to use the MS compiler to build their own corlib for much longer than us, the window of opportunity for the evil MS to inject a trojan on their system was much bigger, so there is no additional guarantee and people are deluding themselves if they think there is. An attack on the original mcs binary would have been very sophitsticated, still someone thinks it would be possible to detect such an attack by ignoring an equivalently-sophisticated attack. lupus -- - [EMAIL PROTECTED] debian/rules [EMAIL PROTECTED] Monkeys do it better ___ Mono-list maillist - [EMAIL PROTECTED] http://lists.ximian.com/mailman/listinfo/mono-list
Re: [Mono-list] Re: Bootstrapping
On Thu, 2004-07-08 at 01:03, Brandon Knitter wrote: > The initial question still stands though. How was the bootstrap compiler built. > I'll dig through the HISTORY and find it, its notes, and perhaps its source. For C: http://cm.bell-labs.com/cm/cs/who/dmr/chist.html I originally would have said that the first C compiler would be written in PDP-7 assembly, which wouldn't be too unusual given that *lots* of things were written in PDP-7 assembler. (And for comparison, VAX assembly has been compared to FORTRAN, so this isn't your typical assembly.) However, the above article makes it sound like C came from the NB ("new B") compiler, which came from the B compiler, which... One of those compilers probably originated in an assembly program, but I don't want to read the article that carefully now. The Microsoft csc C# compiler is written in C++, so there are no bootstrapping issues. Mono's mcs C# compiler was written in C#, and originally compiled with csc. So csc was the original bootstrap compiler, but now a previous version of the C# compiler is used. For example, the Mono 0.97 compiler could be used to compile the Mono 1.0 compiler. PNET's C# compiler is written in C, so there are no bootstrapping issues. > Sorry to push this so far, but I really wanted to know why/how the bootstrapping > required a download. Why not just bootstrap from a K&R C-based program? ;-) K&R C?! Are you insane? ANSI C89 at least :-D The reason to require a download is very simple: minimize duplication of resources. If you wanted to bootstrap from a C program, you'd basically need to write a C# compiler in C, in *addition* to the existing C# compiler. Maintaining two separate C# compilers is not a trivial task, especially when you have More Important Things to do (JIT compiler, class library, regression tests, bug fixing the C# compiler...). So then you ask: why write the C# compiler in C#? Elegance, to better learn the C# language, and most importantly, because it's not C. ;-) It also made a good test suite for the initial class library -- if mcs couldn't compile itself, you broke the class library. :-) Besides, between the Mono and PNET projects we've effectively done the dual compiler scenario. For a full "from source" bootstrap you'd just need to get PNET's compiler to be able to process the Mono class libraries. This may already be possible, but I haven't tried it. - Jon ___ Mono-list maillist - [EMAIL PROTECTED] http://lists.ximian.com/mailman/listinfo/mono-list
Re: [Mono-list] Re: Bootstrapping
Pnet's cscc can compile mcs itself, if you use make BOOT_COMPILE="cscc". Mono's corlib still causes a few problems, which actually seem to be related to issues with the response files. On Wednesday 07 July 2004 11:39 pm, Iain McCoy wrote: > The components written in c# were initially compiled on windows using > csc. If you look back in the history of the mono project, you'll find a > few announcements from when they got the c# components to be > self-hosting. > > If you want to do a full bootstrap from scratch, I think you can still > use microsoft's implementation to do so. It may be possible to use the > pnet c# compiler as well, but I haven't heard of anyone doing so. ___ Mono-list maillist - [EMAIL PROTECTED] http://lists.ximian.com/mailman/listinfo/mono-list
Re: [Mono-list] Re: Bootstrapping
In regards to: > > > How did you compile GCC? You need to have a pre-compiled or > > > cross-compiled version of the compiler to build it the first time. It's > > > the same story here. > > > > GCC has a valid 3 phased bootstraping which builds the compiler in stages. > > > > GCC doesn't require a C compiler to be compiled, although it does speed up > > the process. > > I have to quote from the page http://gcc.gnu.org/install/prerequisites.html: > > ``Tools/packages necessary for building GCC > > ``ISO C90 compiler > Necessary to bootstrap the GCC package, although versions of GCC prior to 3.4 > also allow bootstrapping with a traditional (K&R) C compiler. > > ``To make all languages in a cross-compiler or other configuration where > 3-stage bootstrap is not performed, you need to start with an existing GCC > binary (version 2.95 or later) because source code for language frontends > other than C might use GCC extensions.'' I stand corrected. I guess in these cases the OS provider will distribute some rudementary compiler, although it's not designed to provide much more functionality than bootstrapping. I was under the impression that a simple yacc, or other compiler compiler script, was used to form some sort of base product. I stand here admintting my wrongness. :-O The initial question still stands though. How was the bootstrap compiler built. I'll dig through the HISTORY and find it, its notes, and perhaps its source. Sorry to push this so far, but I really wanted to know why/how the bootstrapping required a download. Why not just bootstrap from a K&R C-based program? ;-) Thanks for the education. URL: http://en.wikipedia.org/wiki/C_programming_language#K.26R_C -- -bk ___ Mono-list maillist - [EMAIL PROTECTED] http://lists.ximian.com/mailman/listinfo/mono-list
Re: [Mono-list] Re: Bootstrapping
On Thu, 2004-07-08 at 14:22, Brandon Knitter wrote: > This is a chicken and the egg thing. I just want to build the thing from > scratch and am confused (and concerned) how this is possible. The components written in c# were initially compiled on windows using csc. If you look back in the history of the mono project, you'll find a few announcements from when they got the c# components to be self-hosting. If you want to do a full bootstrap from scratch, I think you can still use microsoft's implementation to do so. It may be possible to use the pnet c# compiler as well, but I haven't heard of anyone doing so. -- Iain McCoy <[EMAIL PROTECTED]> ___ Mono-list maillist - [EMAIL PROTECTED] http://lists.ximian.com/mailman/listinfo/mono-list
Re: [Mono-list] Re: Bootstrapping
I have to quote from the page http://gcc.gnu.org/install/prerequisites.html: ``Tools/packages necessary for building GCC ``ISO C90 compiler Necessary to bootstrap the GCC package, although versions of GCC prior to 3.4 also allow bootstrapping with a traditional (K&R) C compiler. ``To make all languages in a cross-compiler or other configuration where 3-stage bootstrap is not performed, you need to start with an existing GCC binary (version 2.95 or later) because source code for language frontends other than C might use GCC extensions.'' On Wednesday 07 July 2004 11:22 pm, Brandon Knitter wrote: > > How did you compile GCC? You need to have a pre-compiled or > > cross-compiled version of the compiler to build it the first time. It's > > the same story here. > > GCC has a valid 3 phased bootstraping which builds the compiler in stages. > GCC doesn't require a C compiler to be compiled, although it does speed up > the process. ___ Mono-list maillist - [EMAIL PROTECTED] http://lists.ximian.com/mailman/listinfo/mono-list
RE: [Mono-list] Re: Bootstrapping
> The VERY first C compiler was probably written in Assembly, or Pascal, or > something... If we were really paranoid, we'd keep the source for that > around. And the PDP/8 it ran on ;-) (Brian Kernighan has a great speech on > this topic, btw: http://www.acm.org/classics/sep95/) I'm not paranoid, I'm trying to understand *exactly* how Mono was written. Although, if it was written in Assembly I'm going to run in fear! ;-) > Mono, the runtime wasn't written in C#, was it? If so, is it reasonable > to expect to boot-strap mono something like this? > > 1) build MCS using .NET on Windows > 2) build the runtime > 3) use the output of 2) to run the output of 1) to self-compile Yeah, that would be fine. I can't download blackbox binary to compile Mono and do a full security review. I'd like to see more core of core, and build it from there. If this isn't possible, perhaps one of the Mono developers could [sideline?] discuss with me what was done. I want the chicken *and* the egg! One or the other will not suffice! ;-) -- -bk ___ Mono-list maillist - [EMAIL PROTECTED] http://lists.ximian.com/mailman/listinfo/mono-list
Re: [Mono-list] Re: Bootstrapping
> How did you compile GCC? You need to have a pre-compiled or > cross-compiled version of the compiler to build it the first time. It's > the same story here. GCC has a valid 3 phased bootstraping which builds the compiler in stages. GCC doesn't require a C compiler to be compiled, although it does speed up the process. This is a chicken and the egg thing. I just want to build the thing from scratch and am confused (and concerned) how this is possible. -- -bk ___ Mono-list maillist - [EMAIL PROTECTED] http://lists.ximian.com/mailman/listinfo/mono-list
RE: [Mono-list] Re: Bootstrapping
> An initial C# compiler. > > How did *that* get compiled? I'm trying to do this *completely* from > > scratch. > The mono C# compiler is written in C#, just like the GNU C compiler is > written in C. > How did you compile GCC? You need to have a pre-compiled or > cross-compiled version of the compiler to build it the first time. It's > the same story here. The VERY first C compiler was probably written in Assembly, or Pascal, or something... If we were really paranoid, we'd keep the source for that around. And the PDP/8 it ran on ;-) (Brian Kernighan has a great speech on this topic, btw: http://www.acm.org/classics/sep95/) Mono, the runtime wasn't written in C#, was it? If so, is it reasonable to expect to boot-strap mono something like this? 1) build MCS using .NET on Windows 2) build the runtime 3) use the output of 2) to run the output of 1) to self-compile Cheers, / h+ ___ Mono-list maillist - [EMAIL PROTECTED] http://lists.ximian.com/mailman/listinfo/mono-list
Re: [Mono-list] Re: Bootstrapping
Hi, Brandon Knitter <[EMAIL PROTECTED]> writes: >> * if you have a working mono installation, run >> >> make bootstrap && make install > > I'm trying to build without a preexisting copy. > >> * otherwise >> >> make get-monolite-latest && make monolite-bootstrap && make install > > This simply downloads an initial mono compile. An initial C# compiler. > How did *that* get compiled? I'm trying to do this *completely* from > scratch. The mono C# compiler is written in C#, just like the GNU C compiler is written in C. How did you compile GCC? You need to have a pre-compiled or cross-compiled version of the compiler to build it the first time. It's the same story here. - Hari ___ Mono-list maillist - [EMAIL PROTECTED] http://lists.ximian.com/mailman/listinfo/mono-list
Re: [Mono-list] Re: Bootstrapping
> * if you have a working mono installation, run > > make bootstrap && make install I'm trying to build without a preexisting copy. > * otherwise > > make get-monolite-latest && make monolite-bootstrap && make install This simply downloads an initial mono compile. How did *that* get compiled? I'm trying to do this *completely* from scratch. -- -bk ___ Mono-list maillist - [EMAIL PROTECTED] http://lists.ximian.com/mailman/listinfo/mono-list