Reflections on trusting trust

1984/08/01 by Ken Thompson · 16 citations
Computer Science · #Advanced Malware Detection Techniques #Security and Verification in Computing #Physical Unclonable Functions (PUFs) and Hardware Security

paper · pdf · doi:10.1145/358198.358210

Abstract

To what extent should one trust a statement that a program is free of Trojan horses? Perhaps it is more important to trust the people who wrote the software.

Cited by

• Sandboxing: Foolproof Boundaries vs. Unbounded Foolishness
• No Snake Oil: Verifying Python Package Builds
• Trusting-Trust Attack against an Entire Linux Distribution through Binary Manipulation
• Software Supply Chain Security of Web3
• Research Directions in Software Supply Chain Security
• Kleene, Rogers and Rice Theorems Revisited in C and in Bash
• Truth Without Comprehension: A BlueSky Agenda for Steering the Fourth Mathematical Crisis
• On Vulnerabilities, Constraints and Assumptions
• Reproducible Builds: Increasing the Integrity of Software Supply Chains
• Verification of a Cryptographic Primitive
• Trojan Source: Invisible Vulnerabilities
• Measuring the Vulnerability Disclosure Policies of AI Vendors
• Certified Compilation based on Gödel Numbers
• Toward a Trust Evaluation Mechanism in the Social Internet of Things. [europepmc]
• Hardware Trojan Attacks on the Reconfigurable Interconnections of Field-Programmable Gate Array-Based Convolutional Neural Network Accelerators and a Physically Unclonable Function-Based Countermeasure Detection Technique. [europepmc]
• Supply Chain Risk: Measurement and Real Effects [europepmc]

Related

• A Systematic Literature Review on Trust in the Software Ecosystem
• Why Trust is Bad for Security
• Trust Challenges in Reusing Open Source Software: An Interview-based Initial Study
• Zero Trust: The What, How, Why, and When
• On the Need to Rethink Trust in AI Assistants for Software Development: A Critical Review