Reflections on Trusting Trust (1984) [pdf]

- Ken Thompson's 1984 Turing Award lecture, now a legendary paper in computer security. Thompson co-created Unix and the C programming language at Bell Labs. - The paper demonstrates a "trusting trust" attack: a malicious compiler can inject a backdoor into any program it compiles, including future versions of itself, while removing all traces of the exploit from its own source code. - This means you cannot trust software simply by auditing its source code, because the compiler that built the software may have been compromised in a way that is invisible at the source level. - The attack is not a theoretical parlor trick — Thompson wrote a working proof of concept — and it has inspired real-world supply-chain attacks like the 2015 XcodeGhost incident and the 2024 xz backdoor. - The paper coined the phrase "reflections on trusting trust" and remains a foundational argument for reproducible builds, verified compilers, and cryptographic signing of software supply chains.