Legal Commentary

There Is a Difference Between Warning About Something and Doing It

By Professor University of Miami School of Law

I know, I know, I have a case of this today:

…but forgive me.

There is a very serious error in the IT World posting Can you trust Chinese computer equipment?. I've written to the author to ask him to correct it, and to post the correction to Slashdot, which has repeated the error (which is how I came to find it).

The original item states,

Indeed, back in 1983, Ken Thompson, one the creators of Unix, admitted that he had included a backdoor in early Unix versions. Thompson's backdoor gave him access to every Unix system then in existence.

“Why am I always the last guy in the world to hear about this stuff?” I wondered. In this case, it is because it is not so. If you look at the actual article referenced, Ken Thompson's Reflections on Trusting Trust, his famous acceptance speech for the Turing Award, you will see it basically says the opposite of what the quote above suggests.

For starters, the very elegant backdoor attack presented in Ken Thompson's paper is a PROOF OF CONCEPT not an “admission” that anyone in fact did anything like it to early or late Unix builds. Ken Thompson in fact takes a very strong stand against such hacks. His point, though, is that the nature of compilers makes what have become known as “Thompson hack” or trusting trust attack very hard to detect.

It would be good if IT World ran a correction; if not maybe someone trying to chase down this latest piece of tin foil will find this posting instead.

Full post as published by Discourse.net on February 05, 2010 (boomark / email).