That Time Ken Thompson Wrote a Backdoor Into the C Compiler
Key topics
The article discusses Ken Thompson's 1984 paper 'Reflections on Trusting Trust', which describes how he inserted a backdoor into the C compiler, and the discussion revolves around the implications and relevance of this work to modern software development and security.
Snapshot generated from the HN discussion
Discussion Activity
Light discussionFirst comment
1h
Peak period
4
2-4h
Avg / period
1.9
Based on 13 loaded comments
Key moments
- 01Story posted
Oct 25, 2025 at 3:03 AM EDT
2 months ago
Step 01 - 02First comment
Oct 25, 2025 at 4:17 AM EDT
1h after posting
Step 02 - 03Peak activity
4 comments in 2-4h
Hottest window of the conversation
Step 03 - 04Latest activity
Oct 25, 2025 at 8:18 PM EDT
2 months ago
Step 04
Generating AI Summary...
Analyzing up to 500 comments to identify key contributors and discussion patterns
Want the full context?
Jump to the original sources
Read the primary article or dive into the live Hacker News thread when you're ready.
Is that related to Godel's idea that a system can be either complete or inconsistent?
0: https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...
1: https://guix.gnu.org/en/blog/2023/the-full-source-bootstrap-...
I gave a talk about this at WHY2025 which also refers to this 'Reflections on Trusting Trust' paper. On YouTube https://www.youtube.com/watch?v=akzyyO5wvm0
kaem is a new one for me, what's its connection to mescc?
To compile GNU Mes compiler you need a minimal C compiler. Half of the steps in stage0 consist of building that minimal C compiler through a number of steps starting with a very minimal assembler. I am working on an approach that use far less steps and is easier to review than the hunderds of files that are used now.
I have never seen the actual examples before, but the way it's always been described to me I kind of expected more...
It was always described as completely undetectable... so my assumption was one could not find it even with a decompiler and a lot of free time...
I guess I expected for instance it to filter patterns of itself out of fread for instance, such that a system built with it literally could not detect its existence at all. I expected it to make the operating system at large lie to you.
A better approach is to start with a small executable, one that translate hexadecimal numbers to binary, and from that build all the tools to compile a simple C compiler (such as the Tiny C Compiler, which is not very tiny), to compile the optimizing C compiler that can compile operating systems. That is the approach followed by the live-bootstrap project.
Understatement of the eon