Received: (from major@localhost)
	by minnie.cs.adfa.edu.au (8.9.3/8.9.3) id UAA48301
	for pups-liszt; Thu, 6 Jan 2000 20:35:35 +1100 (EST)
Received: from nose.cita.utoronto.ca (nose.cita.utoronto.ca [128.100.76.157])
	by minnie.cs.adfa.edu.au (8.9.3/8.9.3) with SMTP id UAA48295
	for <pups@minnie.cs.adfa.edu.au>; Thu, 6 Jan 2000 20:35:13 +1100 (EST)
From: norman@nose.cita.utoronto.ca
Message-Id: <200001060935.UAA48295@minnie.cs.adfa.edu.au>
Subject: Re: Viral Unix Compiler
To: pups@minnie.cs.adfa.edu.au
Date: Thu, 06 Jan 2000 04:34:51 -0500
Sender: owner-pups@minnie.cs.adfa.edu.au
Precedence: bulk

So far as I know (from conversations with insiders in the past), no system
was ever shipped out of Bell Labs with Ken's self-healing trojan horse in
login and the C compiler.  (For those who don't remember, both programs
were involved: login buggered so that a secret string was always accepted
as a valid password for any login; the compiler buggered to recognize when
compiling login or itself, and reinsert the buggery.  Hence one can remove
the buggered sources, but as long as the binaries remain, so will the bugs.)

Ken's Turing Award lecture doesn't say whether those programs were ever
shipped to the public.  He probably left it dangling on purpose, since
the point he is trying to make is that it isn't just code you have to trust,
but the programmer who wrote it; you cannot possibly know everything that's
going on inside unless you created everything involved, including compilers
and assemblers and the operating system.

Dennis's Turing Award lecture in the same issue of CACM is worth re-reading too,
especially for those who think that Open Source is a cure for the common
cold or that it was invented in the 1990s or 1980s.

Norman Wilson