What is to stop an adversary from inserting malicious code through Monero's compiling software?

Question

I know Monero typically uses things like the make command to compile its software, and I assume that these compilers are software themselves. What is to stop this compiling software from getting compromised, where an adversary could insert vulnerabilities and malicious code without the community knowing?

Answer 1

It depends on how you got make/gcc/etc. in the first place. I'm going to assume that you got an "official" copy and verified its signature (which is automatically done if you use a package managemement system, like apt for example).

So someone would have to push a malicious change to the compiler codebase and have that change go through the 100s of pairs of eyes that monitor the code without anybody noticing. That's very unlikely and, to be honest, less probable than having a bug (malicious or not) in the monero codebase.

In the end, you could have malicious code running on your hardware, in your OS, in the compiler etc.: you always have to trust someone...