# Supporter spotlight: David A. Wheeler on supply chain security

DevFeed: [Supporter spotlight: David A. Wheeler on supply chain security](<https://devfeed.tech/articles/supporter-spotlight-david-a-wheeler-on-supply-chain-security-34154.md>)

Original publisher: [Read original article](<https://reproducible-builds.org/news/2022/12/15/supporter-spotlight-davidawheeler-supply-chain-security/>)

Published: 2022-12-15T12:00:00Z

Content type: news

Language: en

Sources: [reproducible-builds.org](<https://devfeed.tech/sources/reproducible-builds-org.md>)

Topics: [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [Security](<https://devfeed.tech/topics/security.md>), [reproducible builds](<https://devfeed.tech/topics/reproducible-builds.md>), [linux foundation](<https://devfeed.tech/topics/linux-foundation.md>), [open-source-security](<https://devfeed.tech/topics/open-source-security.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [compilers](<https://devfeed.tech/topics/compilers.md>)

Tags: [compilers](<https://devfeed.tech/tags/compilers.md>), [linux](<https://devfeed.tech/tags/linux.md>), [linux-foundation](<https://devfeed.tech/tags/linux-foundation.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [org](<https://devfeed.tech/tags/org.md>), [reproducible-builds](<https://devfeed.tech/tags/reproducible-builds.md>), [security](<https://devfeed.tech/tags/security.md>), [software](<https://devfeed.tech/tags/software.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>)

## AI overview

An interview with David A. Wheeler, the Linux Foundation's Director of Open Source Supply Chain Security, about improving security across open source software development, builds, distribution, and use. It also discusses reproducible builds and Diverse Double-Compiling as a way to detect trusting trust attacks.

## Source excerpt

The Reproducible Builds project relies on several projects, supporters and sponsors for financial support, but they are also valued as ambassadors who spread the word about our project and the work that we do. This is the sixth instalment in a series featuring the projects, companies and individuals who support the Reproducible Builds project. We started this series by featuring the Civil Infrastructure Platform project and followed this up with a post about the Ford Foundation as well as a recent ones about ARDC, the Google Open Source Security Team (GOSST), Jan Nieuwenhuizen on Bootstrappable Builds, GNU Mes and GNU Guix and Hans-Christoph Steiner of the F-Droid project. Today, however, we will be talking with David A. Wheeler, the Director of Open Source Supply Chain Security at the Linux Foundation. Holger Levsen: Welcome, David, thanks for taking the time to talk with us today. First, could you briefly tell me about yourself? David: Sure! I'm David A. Wheeler and I work for the Linux Foundation as the Director of Open Source Supply Chain Security. That just means that my job is to help open source software projects improve their security, including its development, build, distribution, and incorporation in larger works, all the way out to its eventual use by end-users. In my copious free time I also teach at George Mason University (GMU); in particular, I teach a graduate course on how to design and implement secure software. My background is technical. I have a Bachelor's in Electronics Engineering, a Master's in Computer Science and a PhD in Information Technology. My PhD dissertation is connected to reproducible builds. My PhD dissertation was on countering the 'Trusting Trust' attack, an attack that subverts fundamental build system tools such as compilers. The attack was discovered by Karger & Schell in the 1970s, and later demonstrated & popularized by Ken Thompson. In my dissertation on 'trusting trust' I showed that a process called 'Diverse Double-Comp