Reflections on Trusting Trust Alive

Thompson described a compiler that, taught to insert a login backdoor into Unix, could teach all its descendants the same trick — even after the backdoor was removed from every source file. The binaries carry it forever; source review cannot see it.

Three pages, delivered as a Turing Award lecture, redefined what 'verify' means: you can't trust what you didn't build entirely — compiler, libraries, hardware. It anticipated supply-chain attacks by four decades; reproducible builds are the field's ongoing answer.