I just published a deep dive on Ken Thompson’s Reflections on Trusting Trust, where he talks about the compiler-level backdoor he described in his 1984 Turing Award lecture that would let him login on compromised systems.
The post walks through how a compiler can teach itself to hide a Trojan that reproduces even after the source is “clean” and annotated snippets from Thompson’s actual code (shared by Russ Cox).
Would love feedback or corrections, especially from folks who’ve studied or implemented compiler bootstrapping or reproducible-build systems.
The post walks through how a compiler can teach itself to hide a Trojan that reproduces even after the source is “clean” and annotated snippets from Thompson’s actual code (shared by Russ Cox).
Would love feedback or corrections, especially from folks who’ve studied or implemented compiler bootstrapping or reproducible-build systems.