Ken Thompson

lore

programmingsecurity

Co-creator of Unix and joint recipient of the 1983 Turing Award, and author of the Turing lecture that showed a compiler can hide a backdoor no source review would ever find.

The lecture is the part that belongs on a security site. He described a compiler modified to insert a backdoor into a program, and to insert the same modification into any compiler it compiles - so the malicious code disappears from every source file while surviving in every binary. The conclusion he drew is the uncomfortable one: you cannot trust code you did not totally create yourself, and reading the source is not enough, because the thing that reads the source is also code. Reproducible builds and supply-chain attestation exist because of an argument he made in 1984.

Also known as: thompson, ken

All glossary entries