I apologize if I sound terse here, but this conversation has (IMO) jumped the shark.
> But how can we be confident? Cf. Thompson, K. _Reflections on trusting trust_. Comm. ACM 27, 8 (Aug. 1984), 761-763. A digital version of it is currently available at http://www.acm.org/ classics/sep95/, but links tend to be ephemeral, so read it while you can. Once you've read it, decide whether you can even trust the compiler you're using to compile GnuPG. Finally, come back here and see whether that same logic can be used to decide whether to trust GnuPG. If you're chasing a neverending shadow of "well, someone might attack the system this way...", you're ultimately left hand-hacking machine instructions for a low transistor count chip whose design you have personally validated and lithographed onto a sliver of six-nines pure silicon you smelted yourself. That's what lies at the bottom of this rabbit hole. _______________________________________________ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users