Re: [Mono-list] Re: Bootstrapping

2004-07-18 Thread Raja R Harinath
Hi,

Brandon Knitter [EMAIL PROTECTED] writes:

 The VERY first C compiler was probably written in Assembly, or Pascal, or
 something... If we were really paranoid, we'd keep the source for that
 around. And the PDP/8 it ran on ;-) (Brian Kernighan has a great speech on
 this topic, btw: http://www.acm.org/classics/sep95/)

 I'm not paranoid, I'm trying to understand *exactly* how Mono was written. 
 Although, if it was written in Assembly I'm going to run in fear! ;-)

 Mono, the runtime wasn't written in C#, was it? If so, is it reasonable
 to expect to boot-strap mono something like this?
 
 1) build MCS using .NET on Windows
 2) build the runtime
 3) use the output of 2) to run the output of 1) to self-compile

 Yeah, that would be fine.  I can't download blackbox binary to compile Mono and
 do a full security review.  I'd like to see more core of core, and build it from
 there.

So, you're willing to download a blackbox compiler from Microsoft ???

- Hari
___
Mono-list maillist  -  [EMAIL PROTECTED]
http://lists.ximian.com/mailman/listinfo/mono-list


Re: [Mono-list] Re: Bootstrapping

2004-07-13 Thread Norbert Bollow
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Todd Berman [EMAIL PROTECTED] wrote:

 Just out of curiosity, who the hell cares?
 
 Neither one is trojaned. Lets just move on.

I have decided to honor your request and move on, i.e. this
is going to be my last posting in this thread.

However, I'd like you to understand why at least from my
perspective this is not a satisfactory resolution:

I believe that many people will agree with me when I say that
it is evil monopolistic bahavior when Microsoft spreads FUD
against GNU/Linux, the GPL, and the open source movement.

Now Novell apparantly also has a policy of spreading FUD, namely
against a GNU project that their Mono project happens to
compete with.  That is essentially the same kind of behavior.

Novell should stop this behavior and issue an official, public
apology which covers both this and their previous FUD attacks.

Greetings, Norbert.

- -- 
Founder  Steering Committee member of DotGNU, see http://dotgnu.org/
Free Software Business Strategy Guide   ---  http://FreeStrategy.info
Norbert Bollow, Weidlistr.18, CH-8624 Gruet (near Zurich, Switzerland)
Tel +41 1 972 20 59Fax +41 1 972 20 69   http://norbert.ch
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFA8/TKoYIVvXUl7DIRAjjiAJ40/M3iH57N5FwkLxelRCk4Y+H5QgCgxc1q
liVbMOYJbEP/LmPvhf1w1t8=
=eKBY
-END PGP SIGNATURE-
___
Mono-list maillist  -  [EMAIL PROTECTED]
http://lists.ximian.com/mailman/listinfo/mono-list


Re: [Mono-list] Re: Bootstrapping

2004-07-13 Thread Miguel de Icaza
Hello,

 Now Novell apparantly also has a policy of spreading FUD, namely
 against a GNU project that their Mono project happens to
 compete with.  That is essentially the same kind of behavior.
 
 Novell should stop this behavior and issue an official, public
 apology which covers both this and their previous FUD attacks.

I can officially state that there is no such policy in place.

People disagree violently over mailing lists, big deal.

Miguel.
___
Mono-list maillist  -  [EMAIL PROTECTED]
http://lists.ximian.com/mailman/listinfo/mono-list


Re: [Mono-list] Re: Bootstrapping

2004-07-13 Thread Jonathan Gilbert
At 04:47 PM 13/07/2004 +0200, Norbert Bollow nb-at-SoftwareEconomics.biz
|mono-list subscript wrote:
Todd Berman [EMAIL PROTECTED] wrote:
 Just out of curiosity, who the hell cares?
 
 Neither one is trojaned. Lets just move on.

I have decided to honor your request and move on, i.e. this
is going to be my last posting in this thread.

However, I'd like you to understand why at least from my
perspective this is not a satisfactory resolution:

I believe that many people will agree with me when I say that
it is evil monopolistic bahavior when Microsoft spreads FUD
against GNU/Linux, the GPL, and the open source movement.

Now Novell apparantly also has a policy of spreading FUD, namely
against a GNU project that their Mono project happens to
compete with.  That is essentially the same kind of behavior.

Novell should stop this behavior and issue an official, public
apology which covers both this and their previous FUD attacks.

There is no FUD here. You have a history of paranoia and friction with the
Mono project and its managers. Never did Miguel actually suggest that
either project was trojaned. He merely stated the possibility, and you
immediately and emphatically denied even that possibility. However, anyone
with a basic understanding of security and compiler technology can see that
it IS possible. It is possible, but it hasn't actually been done. All that
Miguel said was no project is immune to tampering, hacking and trojan
horses.

I do not expect you to answer this message, because, as you said, this is
your last posting in this thread. Just, please understand that posts like
the one you have made here do not serve any purpose, except to annoy all
other people on this list, contributors or not, including those (and I'm
sure they exist) who are involved with DotGNU/Portable.NET.

Please stop fighting with us and get on with developing your project.

Jonathan

___
Mono-list maillist  -  [EMAIL PROTECTED]
http://lists.ximian.com/mailman/listinfo/mono-list


Re: [Mono-list] Re: Bootstrapping

2004-07-12 Thread Norbert Bollow
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Paolo Molaro [EMAIL PROTECTED] wrote:

  Is this an attempt to spread FUD (Fear, Uncertainty and Doubt) about
  the DotGNU Portable.Net (pnet) system, or did you honestly write the
  above without thinking about the matter first?
 
 It's not FUD, it's just the reality: if people think that using pnet is
 safer wrt a possible trojan injected by MS, they are deluding
 themselves (and showing they don't know much about security).

You claimed that MS had more opportunity to inject a trojan into
our system than they had for injecting a trojan into yours, thereby
implying that that would have been possible for them.  Since the kind
of attack which was under discussion is possible only with compilers
which are used to compile themselves (which is the case with mono's
compiler but not with the DotGNU Portable.Net system), the statement
which you made is FUD and you owe us an apology for it.

 Unless the C compiler (for example) was trojaned by the Console.WriteLine()
 implementation (emitted by the hyphotetical trojaning MS compiler) when
 the first tests were run with pnet. So the moment you ran untrusted code
 on the system, it doesn't matter if you bootstrap from C or from C#.

Even more FUD.  Even if (as you seem to imply) a hypothetical
trojaning MS compiler had trojaned early pnetlib builds in a way which
exploits some kernel security hole on GNU/Linux systems to gain root
privileges to modify the C compiler installation on that machine, that
would not have affected the binaries which we distribute today because
they're built on other machines which have probably never received
_any_ binaries from the machines where the early tests were done.  (If
in your opinion the probably above isn't good enough, let me know; I
can easily enough do a round of builds on machines where I can guarantee
this to be the case.)

 Just as a summary, since people seem to be sensitive about these issues:
 *) I don't think MS has trojaned either mono or pnet
 *) if they could have trojaned mono, they could have done the same to pnet
 *) since the trojaning of both systems is theoretical it's not easy to
 say which one of the two could be more likely, but feel free to discuss
 it in the [EMAIL PROTECTED] list:-)

I do think that the (at least theoretical) possibility of trojaned
self-compiling compilers should be on the long list of potential
issues to take into consideration.  I do not think that it is
appropriate to single out MS as the only potential attacker.

I believe that good security can be achieved only by taking into
consideration all possible attacks from all possible attackers.  Is
the Mono project leadership in disagreement with this view?

Greetings, Norbert.

- -- 
Founder  Steering Committee member of DotGNU, see http://dotgnu.org/
Free Software Business Strategy Guide   ---  http://FreeStrategy.info
Norbert Bollow, Weidlistr.18, CH-8624 Gruet (near Zurich, Switzerland)
Tel +41 1 972 20 59Fax +41 1 972 20 69   http://norbert.ch
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFA8p0uoYIVvXUl7DIRAtyCAKDVHhHRr2zfqivIoejt1JWSWoVf4ACgsNEB
I2A4ZMmPczZ9bexxWGvw8sM=
=0Kuz
-END PGP SIGNATURE-
___
Mono-list maillist  -  [EMAIL PROTECTED]
http://lists.ximian.com/mailman/listinfo/mono-list


RE: [Mono-list] Re: Bootstrapping

2004-07-12 Thread Jon Watte

 I believe that good security can be achieved only by taking into
 consideration all possible attacks from all possible attackers.  Is
 the Mono project leadership in disagreement with this view?

Good risk management will allocate resources to possible attacks 
in proportion to:

- their assumed chance of occuring
- the assumed extent of the damage of such an attack
- the leverage which can be achieved against such an attack

For example:

If there's a chance of the NSA having a crack for RSA crypto, 
and all your secrets will be known by the government, but you 
just have no way of figuring out how to build a new cryptosystem, 
then you probably are still doing the risk analysis that RSA is 
good enough.

I believe that all three of these criteria will push this risk 
to the bottom of the pile WRT mono task lists. But if you feel 
different, I think there's room to contribute ;-)

Cheers,

/ h+


___
Mono-list maillist  -  [EMAIL PROTECTED]
http://lists.ximian.com/mailman/listinfo/mono-list


Re: [Mono-list] Re: Bootstrapping

2004-07-12 Thread Norbert Bollow
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Jon Watte [EMAIL PROTECTED] wrote:

 I believe that all three of these criteria will push this risk 
 to the bottom of the pile WRT mono task lists.

That sounds reasonable; also I wouldn't object when someone says
that there's nothing wrong with putting it on a risks that we
choose not to address list.

My objection was against a -clearly false- FUD statement of a
Mono project leader about DotGNU having risks in this area.

Also I would like to know what exactly the position of the Mono
project leadership is concerning what security threats should
be taken into consideration, so that I can make sure that I won't
accidentally misrepresent their position.

 But if you feel different, I think there's room to contribute ;-)

I do feel different but I have been at the receiving end of so much
hostility from Mono project leaders that now I'm very sure that I'm
not interested in contributing to Mono, at least as long as these
people are leading.

Greetings, Norbert.

- -- 
Founder  Steering Committee member of DotGNU, see http://dotgnu.org/
Free Software Business Strategy Guide   ---  http://FreeStrategy.info
Norbert Bollow, Weidlistr.18, CH-8624 Gruet (near Zurich, Switzerland)
Tel +41 1 972 20 59Fax +41 1 972 20 69   http://norbert.ch
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFA8sE4oYIVvXUl7DIRAj7CAJ9dRyG9WBL8LKn2AqVbQNFncDQ7ZACg3tcC
PxBMFirDbxAx/T5U79NTX28=
=gLER
-END PGP SIGNATURE-
___
Mono-list maillist  -  [EMAIL PROTECTED]
http://lists.ximian.com/mailman/listinfo/mono-list


Re: [Mono-list] Re: Bootstrapping

2004-07-12 Thread Todd Berman
On Mon, 2004-07-12 at 16:17 +0200, Norbert Bollow wrote:
 -BEGIN PGP SIGNED MESSAGE-
 Hash: SHA1
 
 Paolo Molaro [EMAIL PROTECTED] wrote:
 
   Is this an attempt to spread FUD (Fear, Uncertainty and Doubt) about
   the DotGNU Portable.Net (pnet) system, or did you honestly write the
   above without thinking about the matter first?
  
  It's not FUD, it's just the reality: if people think that using pnet is
  safer wrt a possible trojan injected by MS, they are deluding
  themselves (and showing they don't know much about security).
 
 You claimed that MS had more opportunity to inject a trojan into
 our system than they had for injecting a trojan into yours, thereby
 implying that that would have been possible for them.  Since the kind
 of attack which was under discussion is possible only with compilers
 which are used to compile themselves (which is the case with mono's
 compiler but not with the DotGNU Portable.Net system), the statement
 which you made is FUD and you owe us an apology for it.
 
  Unless the C compiler (for example) was trojaned by the Console.WriteLine()
  implementation (emitted by the hyphotetical trojaning MS compiler) when
  the first tests were run with pnet. So the moment you ran untrusted code
  on the system, it doesn't matter if you bootstrap from C or from C#.
 
 Even more FUD.  Even if (as you seem to imply) a hypothetical
 trojaning MS compiler had trojaned early pnetlib builds in a way which
 exploits some kernel security hole on GNU/Linux systems to gain root
 privileges to modify the C compiler installation on that machine, that
 would not have affected the binaries which we distribute today because
 they're built on other machines which have probably never received
 _any_ binaries from the machines where the early tests were done.  (If
 in your opinion the probably above isn't good enough, let me know; I
 can easily enough do a round of builds on machines where I can guarantee
 this to be the case.)
 
  Just as a summary, since people seem to be sensitive about these issues:
  *) I don't think MS has trojaned either mono or pnet
  *) if they could have trojaned mono, they could have done the same to pnet
  *) since the trojaning of both systems is theoretical it's not easy to
  say which one of the two could be more likely, but feel free to discuss
  it in the [EMAIL PROTECTED] list:-)
 
 I do think that the (at least theoretical) possibility of trojaned
 self-compiling compilers should be on the long list of potential
 issues to take into consideration.  I do not think that it is
 appropriate to single out MS as the only potential attacker.
 
 I believe that good security can be achieved only by taking into
 consideration all possible attacks from all possible attackers.  Is
 the Mono project leadership in disagreement with this view?
 
 Greetings, Norbert.
 
 - -- 
 Founder  Steering Committee member of DotGNU, see http://dotgnu.org/
 Free Software Business Strategy Guide   ---  http://FreeStrategy.info
 Norbert Bollow, Weidlistr.18, CH-8624 Gruet (near Zurich, Switzerland)
 Tel +41 1 972 20 59Fax +41 1 972 20 69   http://norbert.ch
 -BEGIN PGP SIGNATURE-
 Version: GnuPG v1.2.4 (GNU/Linux)
 
 iD8DBQFA8p0uoYIVvXUl7DIRAtyCAKDVHhHRr2zfqivIoejt1JWSWoVf4ACgsNEB
 I2A4ZMmPczZ9bexxWGvw8sM=
 =0Kuz
 -END PGP SIGNATURE-

Just out of curiosity, who the hell cares?

Neither one is trojaned. Lets just move on.

--Todd

___
Mono-list maillist  -  [EMAIL PROTECTED]
http://lists.ximian.com/mailman/listinfo/mono-list


Re: [Mono-list] Re: Bootstrapping

2004-07-09 Thread Paolo Molaro
On 07/08/04 Norbert Bollow wrote:
  Originally mcs and corlib where compiled with csc on windows, so
  paranoid people suppose MS could have injected a trojan. Assuming pnet's
  compiler could compile mcs and corlib correctly, would that give any
  more guarantees? Nope, since thay had to use the MS compiler to build
  their own corlib for much longer than us, the window of opportunity for
  the evil MS to inject a trojan on their system was much bigger, so there
  is no additional guarantee and people are deluding themselves if they
  think there is.
 
 Is this an attempt to spread FUD (Fear, Uncertainty and Doubt) about
 the DotGNU Portable.Net (pnet) system, or did you honestly write the
 above without thinking about the matter first?

It's not FUD, it's just the reality: if people think that using pnet is
safer wrt a possible trojan injected by MS, they are deluding
themselves (and showing they don't know much about security).

 There is no possibility whatsoever that Microsoft could have injected
 a trojan into the DotGNU Portable.Net (pnet) system, since building
 pnet does not require already having a C# compiler or a corlib.

This doesn't matter, see below: the problem is that the systems where pnet 
were built (just as mono) ran untrusted code compiled by the MS csc.

On 07/09/04 Thong (Tum) Nguyen wrote:
 Quite incorrect.  Building pnet's corlib doesn't require an existing corlib
 because PNET's compiler (like MS's compiler) is written in C.  Even if pnet
 used a trojan compiler to compile corlib at one point or another, any
 subsequent recompilation with cscc would overwrite the trojan.

Unless the C compiler (for example) was trojaned by the Console.WriteLine()
implementation (emitted by the hyphotetical trojaning MS compiler) when
the first tests were run with pnet. So the moment you ran untrusted code
on the system, it doesn't matter if you bootstrap from C or from C#.

Just as a summary, since people seem to be sensitive about these issues:
*) I don't think MS has trojaned either mono or pnet
*) if they could have trojaned mono, they could have done the same to pnet
*) since the trojaning of both systems is theoretical it's not easy to
say which one of the two could be more likely, but feel free to discuss
it in the [EMAIL PROTECTED] list:-)

lupus

-- 
-
[EMAIL PROTECTED] debian/rules
[EMAIL PROTECTED] Monkeys do it better
___
Mono-list maillist  -  [EMAIL PROTECTED]
http://lists.ximian.com/mailman/listinfo/mono-list


Re: [Mono-list] Re: Bootstrapping

2004-07-08 Thread Marcus
Pnet's cscc can compile mcs itself, if you use make BOOT_COMPILE=cscc.
Mono's corlib still causes a few problems, which actually seem to be related 
to issues with the response files.


On Wednesday 07 July 2004 11:39 pm, Iain McCoy wrote:
 The components written in c# were initially compiled on windows using
 csc. If you look back in the history of the mono project, you'll find a
 few announcements from when they got the c# components to be
 self-hosting.

 If you want to do a full bootstrap from scratch, I think you can still
 use microsoft's implementation to do so. It may be possible to use the
 pnet c# compiler as well, but I haven't heard of anyone doing so.
___
Mono-list maillist  -  [EMAIL PROTECTED]
http://lists.ximian.com/mailman/listinfo/mono-list


Re: [Mono-list] Re: Bootstrapping

2004-07-08 Thread Paolo Molaro
On 07/08/04 Jonathan Pryor wrote:
 Besides, between the Mono and PNET projects we've effectively done the
 dual compiler scenario.  For a full from source bootstrap you'd just
 need to get PNET's compiler to be able to process the Mono class
 libraries.  This may already be possible, but I haven't tried it.

There is no full from source bootstrap, since you have to start
trusting something somewhere (are you sure your video card shows you the
correct stuff? Is the firmware in your hard-drive trustworthy?).
Originally mcs and corlib where compiled with csc on windows, so
paranoid people suppose MS could have injected a trojan. Assuming pnet's
compiler could compile mcs and corlib correctly, would that give any
more guarantees? Nope, since thay had to use the MS compiler to build
their own corlib for much longer than us, the window of opportunity for
the evil MS to inject a trojan on their system was much bigger, so there
is no additional guarantee and people are deluding themselves if they
think there is. An attack on the original mcs binary would have been
very sophitsticated, still someone thinks it would be possible to detect
such an attack by ignoring an equivalently-sophisticated attack.

lupus

-- 
-
[EMAIL PROTECTED] debian/rules
[EMAIL PROTECTED] Monkeys do it better
___
Mono-list maillist  -  [EMAIL PROTECTED]
http://lists.ximian.com/mailman/listinfo/mono-list


Re: [Mono-list] Re: Bootstrapping

2004-07-08 Thread Brandon Knitter
 There is no full from source bootstrap, since you have to start
 trusting something somewhere

Sorry for the confusion.  I don't think bootstraping from the ground up is
really a trust issue.  It's more of an understanding issue.  Most exploits
aren't done out of malace, but done out of error.

I'm not saying I don't trust things, I just want to understand the nuts and
bolts.  If I wanted to blindly trust Mono, I already do.

--
-bk


___
Mono-list maillist  -  [EMAIL PROTECTED]
http://lists.ximian.com/mailman/listinfo/mono-list


Re: [Mono-list] Re: Bootstrapping

2004-07-08 Thread Brandon Knitter
 The Microsoft csc C# compiler is written in C++, so there are no
 bootstrapping issues.
 
 Mono's mcs C# compiler was written in C#, and originally compiled with
 csc.  So csc was the original bootstrap compiler, but now a previous
 version of the C# compiler is used.  For example, the Mono 0.97 compiler
 could be used to compile the Mono 1.0 compiler.

If the original Mono mcs C# compiler was written and compiled on a Windows
machine, how did it get ported to Linux?  Was there some sort of wine or
wine-ish runtime used to execute csc on Linux to compile the first mcs?

Also, how does this initial bootstrapping binary play out for other platforms? 
When porting to each target platform, will a similar bootstrapping binary have
to be compiled so that the larger mcs compiler can be built?  Who's going to
maintain those?

Thanks,

--
-bk


___
Mono-list maillist  -  [EMAIL PROTECTED]
http://lists.ximian.com/mailman/listinfo/mono-list


Re: [Mono-list] Re: Bootstrapping

2004-07-08 Thread Paolo Molaro
On 07/08/04 Brandon Knitter wrote:
 If the original Mono mcs C# compiler was written and compiled on a Windows
 machine, how did it get ported to Linux?  Was there some sort of wine or
 wine-ish runtime used to execute csc on Linux to compile the first mcs?

The first mcs.exe and corlib.dll binaries were compiled on windows.
While mcs and corlib were being worked on, work was done on linux to
build the CLI runtime that could execute the IL code in mcs and corlib
(at first just as an interpreter, later as a JIT compiler). The
interpreter/JIT and support libraies are written in C. Using the
binaries compiled on windows a new corlib and a new mcs were compiled
(on linux this time) and they have been used to compile new versions of
mcs and corlib since then (with each new version used to compile the
next).

 Also, how does this initial bootstrapping binary play out for other platforms? 
 When porting to each target platform, will a similar bootstrapping binary have
 to be compiled so that the larger mcs compiler can be built?  Who's going to
 maintain those?

There is no larger mcs. The same process above works for any platform
mono works on (except no one uses the windows builds anymore, but we
start from a mcs and corlib binaries built on linux/x86).

lupus

-- 
-
[EMAIL PROTECTED] debian/rules
[EMAIL PROTECTED] Monkeys do it better
___
Mono-list maillist  -  [EMAIL PROTECTED]
http://lists.ximian.com/mailman/listinfo/mono-list


Re: [Mono-list] Re: Bootstrapping

2004-07-08 Thread Miguel de Icaza
Hello,

 So then you ask: why write the C# compiler in C#?  Elegance, to better
 learn the C# language, and most importantly, because it's not C. ;-)

Elegance is also key when it comes to maintaining the code: being able
to fix bugs, using high-level constructs, being able to model new ideas
quickly, be able to `read' the code more easily.

Miguel
___
Mono-list maillist  -  [EMAIL PROTECTED]
http://lists.ximian.com/mailman/listinfo/mono-list


Re: [Mono-list] Re: Bootstrapping

2004-07-08 Thread Miguel de Icaza

 If the original Mono mcs C# compiler was written and compiled on a Windows
 machine, how did it get ported to Linux?  Was there some sort of wine or
 wine-ish runtime used to execute csc on Linux to compile the first mcs?

I guess this explains your confusion.

The code generated in the .NET world is not native x86 code, it is an
intermediate language called CIL which works across many platforms
(provided you have a VM to run it).

See Paolo's post for more details.

But basically the same .exe can be used on Windows and Linux as long as
the compiler is concerned.

Miguel
___
Mono-list maillist  -  [EMAIL PROTECTED]
http://lists.ximian.com/mailman/listinfo/mono-list


Re: [Mono-list] Re: Bootstrapping

2004-07-08 Thread Norbert Bollow
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Paolo Molaro [EMAIL PROTECTED] wrote:

 Originally mcs and corlib where compiled with csc on windows, so
 paranoid people suppose MS could have injected a trojan. Assuming pnet's
 compiler could compile mcs and corlib correctly, would that give any
 more guarantees? Nope, since thay had to use the MS compiler to build
 their own corlib for much longer than us, the window of opportunity for
 the evil MS to inject a trojan on their system was much bigger, so there
 is no additional guarantee and people are deluding themselves if they
 think there is.

Is this an attempt to spread FUD (Fear, Uncertainty and Doubt) about
the DotGNU Portable.Net (pnet) system, or did you honestly write the
above without thinking about the matter first?

There is no possibility whatsoever that Microsoft could have injected
a trojan into the DotGNU Portable.Net (pnet) system, since building
pnet does not require already having a C# compiler or a corlib.

Greetings, Norbert.

- -- 
Founder  Steering Committee member of DotGNU, see http://dotgnu.org/
Free Software Business Strategy Guide   ---  http://FreeStrategy.info
Norbert Bollow, Weidlistr.18, CH-8624 Gruet (near Zurich, Switzerland)
Tel +41 1 972 20 59Fax +41 1 972 20 69   http://norbert.ch
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFA7YMXoYIVvXUl7DIRAtxnAJ49TuS7LtgLPv77+wyWmvyMamSCAwCglDF7
W0GN47GL6Mr8hPH4E6M6mxw=
=UsNz
-END PGP SIGNATURE-
___
Mono-list maillist  -  [EMAIL PROTECTED]
http://lists.ximian.com/mailman/listinfo/mono-list


RE: [Mono-list] Re: Bootstrapping

2004-07-08 Thread Rob . Tillie
Hey all,

 There is no possibility whatsoever that Microsoft could have injected
 a trojan into the DotGNU Portable.Net (pnet) system, since building
 pnet does not require already having a C# compiler or a corlib.

Maybe Intel and AMD put a Trojan in it's proc, so I wouldn't be touching a
pc!

Why the heck does it matter if MS inserted a Trojan... there's nothing in it
for them, only a downside when they get caught...

There's enough of this paranoid crap in the mailinglist, you could read that
instead of starting again...

Greetz,
-- Rob.
___
Mono-list maillist  -  [EMAIL PROTECTED]
http://lists.ximian.com/mailman/listinfo/mono-list


RE: [Mono-list] Re: Bootstrapping

2004-07-08 Thread Thong (Tum) Nguyen


 -Original Message-
 From: [EMAIL PROTECTED] [mailto:mono-list-
 [EMAIL PROTECTED] On Behalf Of Paolo Molaro
 Sent: Friday, 9 July 2004 02:05
 To: [EMAIL PROTECTED]
 Subject: Re: [Mono-list] Re: Bootstrapping
 
 On 07/08/04 Jonathan Pryor wrote:
  Besides, between the Mono and PNET projects we've effectively done the
  dual compiler scenario.  For a full from source bootstrap you'd just
  need to get PNET's compiler to be able to process the Mono class
  libraries.  This may already be possible, but I haven't tried it.
 
 There is no full from source bootstrap, since you have to start
 trusting something somewhere (are you sure your video card shows you the
 correct stuff? Is the firmware in your hard-drive trustworthy?).
 Originally mcs and corlib where compiled with csc on windows, so
 paranoid people suppose MS could have injected a trojan. Assuming pnet's
 compiler could compile mcs and corlib correctly, would that give any
 more guarantees? Nope, since thay had to use the MS compiler to build
 their own corlib for much longer than us, the window of opportunity for
 the evil MS to inject a trojan on their system was much bigger, so there
 is no additional guarantee and people are deluding themselves if they
 think there is. An attack on the original mcs binary would have been
 very sophitsticated, still someone thinks it would be possible to detect
 such an attack by ignoring an equivalently-sophisticated attack.
 

Quite incorrect.  Building pnet's corlib doesn't require an existing corlib
because PNET's compiler (like MS's compiler) is written in C.  Even if pnet
used a trojan compiler to compile corlib at one point or another, any
subsequent recompilation with cscc would overwrite the trojan.

Regards,

^Tum 

___
Mono-list maillist  -  [EMAIL PROTECTED]
http://lists.ximian.com/mailman/listinfo/mono-list


RE: [Mono-list] Re: Bootstrapping

2004-07-07 Thread Brandon Knitter
 The VERY first C compiler was probably written in Assembly, or Pascal, or
 something... If we were really paranoid, we'd keep the source for that
 around. And the PDP/8 it ran on ;-) (Brian Kernighan has a great speech on
 this topic, btw: http://www.acm.org/classics/sep95/)

I'm not paranoid, I'm trying to understand *exactly* how Mono was written. 
Although, if it was written in Assembly I'm going to run in fear! ;-)

 Mono, the runtime wasn't written in C#, was it? If so, is it reasonable
 to expect to boot-strap mono something like this?
 
 1) build MCS using .NET on Windows
 2) build the runtime
 3) use the output of 2) to run the output of 1) to self-compile

Yeah, that would be fine.  I can't download blackbox binary to compile Mono and
do a full security review.  I'd like to see more core of core, and build it from
there.

If this isn't possible, perhaps one of the Mono developers could [sideline?]
discuss with me what was done.

I want the chicken *and* the egg!  One or the other will not suffice! ;-)

--
-bk


___
Mono-list maillist  -  [EMAIL PROTECTED]
http://lists.ximian.com/mailman/listinfo/mono-list


Re: [Mono-list] Re: Bootstrapping

2004-07-07 Thread Marcus
I have to quote from the page http://gcc.gnu.org/install/prerequisites.html:

``Tools/packages necessary for building GCC

 
``ISO C90 compiler
Necessary to bootstrap the GCC package, although versions of GCC prior to 3.4 
also allow bootstrapping with a traditional (KR) C compiler. 

``To make all languages in a cross-compiler or other configuration where 
3-stage bootstrap is not performed, you need to start with an existing GCC 
binary (version 2.95 or later) because source code for language frontends 
other than C might use GCC extensions.''



On Wednesday 07 July 2004 11:22 pm, Brandon Knitter wrote:
  How did you compile GCC?  You need to have a pre-compiled or
  cross-compiled version of the compiler to build it the first time.  It's
  the same story here.

 GCC has a valid 3 phased bootstraping which builds the compiler in stages. 
 GCC doesn't require a C compiler to be compiled, although it does speed up
 the process.
___
Mono-list maillist  -  [EMAIL PROTECTED]
http://lists.ximian.com/mailman/listinfo/mono-list


Re: [Mono-list] Re: Bootstrapping

2004-07-07 Thread Iain McCoy
On Thu, 2004-07-08 at 14:22, Brandon Knitter wrote:
 This is a chicken and the egg thing.  I just want to build the thing from
 scratch and am confused (and concerned) how this is possible.
The components written in c# were initially compiled on windows using
csc. If you look back in the history of the mono project, you'll find a
few announcements from when they got the c# components to be
self-hosting.

If you want to do a full bootstrap from scratch, I think you can still
use microsoft's implementation to do so. It may be possible to use the
pnet c# compiler as well, but I haven't heard of anyone doing so.
-- 
Iain McCoy [EMAIL PROTECTED]

___
Mono-list maillist  -  [EMAIL PROTECTED]
http://lists.ximian.com/mailman/listinfo/mono-list


Re: [Mono-list] Re: Bootstrapping

2004-07-07 Thread Brandon Knitter
In regards to:
   How did you compile GCC?  You need to have a pre-compiled or
   cross-compiled version of the compiler to build it the first time.  It's
   the same story here.
 
  GCC has a valid 3 phased bootstraping which builds the compiler in stages.
  
  GCC doesn't require a C compiler to be compiled, although it does speed up
  the process.

 I have to quote from the page http://gcc.gnu.org/install/prerequisites.html:
 
 ``Tools/packages necessary for building GCC
  
 ``ISO C90 compiler
 Necessary to bootstrap the GCC package, although versions of GCC prior to 3.4
 also allow bootstrapping with a traditional (KR) C compiler. 
 
 ``To make all languages in a cross-compiler or other configuration where 
 3-stage bootstrap is not performed, you need to start with an existing GCC 
 binary (version 2.95 or later) because source code for language frontends 
 other than C might use GCC extensions.''

I stand corrected.  I guess in these cases the OS provider will distribute some
rudementary compiler, although it's not designed to provide much more
functionality than bootstrapping.  I was under the impression that a simple
yacc, or other compiler compiler script, was used to form some sort of base
product.  I stand here admintting my wrongness. :-O

The initial question still stands though.  How was the bootstrap compiler built.
 I'll dig through the HISTORY and find it, its notes, and perhaps its source.

Sorry to push this so far, but I really wanted to know why/how the bootstrapping
required a download.  Why not just bootstrap from a KR C-based program? ;-)

Thanks for the education.
URL: http://en.wikipedia.org/wiki/C_programming_language#K.26R_C

--
-bk


___
Mono-list maillist  -  [EMAIL PROTECTED]
http://lists.ximian.com/mailman/listinfo/mono-list


Re: [Mono-list] Re: Bootstrapping

2004-07-05 Thread Brandon Knitter
   * if you have a working mono installation, run
 
   make bootstrap  make install

I'm trying to build without a preexisting copy.

   * otherwise
 
   make get-monolite-latest  make monolite-bootstrap  make install

This simply downloads an initial mono compile.  How did *that* get compiled? 
I'm trying to do this *completely* from scratch.

--
-bk


___
Mono-list maillist  -  [EMAIL PROTECTED]
http://lists.ximian.com/mailman/listinfo/mono-list


Re: [Mono-list] Re: Bootstrapping

2004-07-05 Thread Raja R Harinath
Hi,

Brandon Knitter [EMAIL PROTECTED] writes:

   * if you have a working mono installation, run
 
   make bootstrap  make install

 I'm trying to build without a preexisting copy.

   * otherwise
 
   make get-monolite-latest  make monolite-bootstrap  make install

 This simply downloads an initial mono compile.  

An initial C# compiler.

 How did *that* get compiled?  I'm trying to do this *completely* from
 scratch.

The mono C# compiler is written in C#, just like the GNU C compiler is
written in C.

How did you compile GCC?  You need to have a pre-compiled or
cross-compiled version of the compiler to build it the first time.  It's
the same story here.

- Hari


___
Mono-list maillist  -  [EMAIL PROTECTED]
http://lists.ximian.com/mailman/listinfo/mono-list