---
id: "20261019-0234-hop-thompson-karger-schell-matthew-effect"
title: "Ken Thompson's Reflections on Trusting Trust names its own decade-older source and still became the origin story — a Matthew-effect instance"
type: "capture"
status: "promoted"
promoted_to: ["30-notes/claim-thompson-1984-credits-karger-schell-1974-matthew-effect.md","40-entities/entity-ken-thompson.md (new hub, person-promotion test passed: real, did something mattering to this vault's domain — co-inventor of UNIX and sole author of the field's canonical self-reference/trust-verification lecture — statable in one sentence)","40-entities/entity-matthew-effect.md (existing hub updated, dated 2026-10-19 line)"]
not_promoted: ["Thompson's 'no source-level verification' thesis as its own claim-note: folded into the promoted note as scene-setting for the Matthew-effect finding rather than split out — per the 2026-10-01 'atomic is not many' ruling, a result, its caveat, and the context it needs are one finding, not several.","Karger & Schell's 1974 trap-door mechanism as its own claim-note: same reasoning — inseparable from the crediting-imbalance finding it supports, not a second independently reusable claim this session found reason to split.","Paul Karger / Roger Schell as separate entity hubs: co-authorship of one joint 1974 report is a mention, not a hub (Cali ruling 2026-10-01); neither has separate standing in this vault yet. Named in prose on the new Ken Thompson hub instead.","Karger & Schell's 2002 'Thirty Years Later' retrospective and the Bit2Watt authors (Ji/Pan/Xu): both listed in the capture's own 'Further leads' as unread hooks, not load-bearing for the kept claim — left as leads rather than routed to 50-questions/, per question-intake discipline (no open verification a kept claim rests on)."]
origin: "hop-batch"
writer_model: "claude-sonnet-5"
date_created: "2026-10-19T00:00:00.000Z"
hop_chain: ["seed: observation-isaac-pitman-bridges-gabelsberger-shorthand-and-ipa-clusters <-> observation-brooks-dreyfus-bit2watt-bridge-tests-seeks-own-lineage (cosine 0.88, unlinked)","Pitman/Bit2Watt seed pairing -> investigated and resolved embedding false friend / dup-risk, logged separately (max_cosine 0.873)","Bit2Watt note's 'the method points back at me' self-referential-audit theme -> Ken Thompson's 1984 Reflections on Trusting Trust (max_cosine 0.719)","Thompson's own acknowledgment citation -> Karger & Schell's 1974 Multics Security Evaluation: Vulnerability Analysis (max_cosine 0.735)","Thompson/Karger-Schell priority pattern -> Robert Merton's 1968 Matthew Effect in Science, confirmed bridge (max_cosine 0.735, frontier)"]
novelty_max_cosine: 0.735
tags: ["cross-domain-bridge","cross-time-period-bridge","matthew-effect","robert-merton","ken-thompson","karger-schell","computer-security","history-of-computing","priority-dispute","epistemics"]
source_url: "https://web.archive.org/web/20010410053444/http://cm.bell-labs.com/who/ken/trust.html"
source_title: "Reflections on Trusting Trust"
source_author: "Ken Thompson"
source_date: "1984-08"
source_venue: "Communications of the ACM 27(8), 761-763; self-hosted reprint at cm.bell-labs.com (domain now dead — read via Wayback Machine capture, 2001-04-10)"
source_tier: 1
source_sha: "a84c95e30cebe6b5583b933b7ad7b7da890f9aa332bb22a7a0e126e9a37a781e"
source_quote: "No amount of source-level verification or scrutiny will protect you from using untrusted code."
source_quote_2: "I first read of the possibility of such a Trojan horse in an Air Force critique (4) of the security of an early implementation of Multics."
source_url_3: "https://www.cs.hunter.cuny.edu/~eschweit/thompson/karg74seePage56.pdf"
source_title_3: "Multics Security Evaluation: Vulnerability Analysis"
source_author_3: "Paul A. Karger and Roger R. Schell"
source_date_3: "1974-06"
source_venue_3: "ESD-TR-74-193, Vol. II; Electronic Systems Division (AFSC), Hanscom AFB"
source_tier_3: 1
source_sha_3: "0a39790386333a9f5f822a707fc703fa57925dad45fbcf9f1d80f07ed3a96f26"
source_quote_3: "A trap door of this type was first placed in the Multics system at MIT in the procedure del_dtr_tree."
source_url_4: "vault:30-notes/claim-merton-1968-coined-the-matthew-effect-in-science.md"
source_title_4: "Robert Merton coined \"the Matthew effect\" in a 1968 Science paper describing skewed credit allocation among scientists"
source_tier_4: 1
seek_code_commit: "17d9798"
---


Ken Thompson's 1984 Turing Award lecture, "[[entity-ken-thompson|Reflections on Trusting Trust]]," is the canonical reference for the idea that a compiler can carry a self-perpetuating backdoor invisible in source code: "No amount of source-level verification or scrutiny will protect you from using untrusted code" (source_quote; Tier 1, Thompson's own self-hosted reprint, read via Wayback Machine since cm.bell-labs.com no longer resolves).

Thompson did not claim originality. His own acknowledgment names a source: "I first read of the possibility of such a Trojan horse in an Air Force critique (4) of the security of an early implementation of Multics" (source_quote_2), citing Karger & Schell's *Multics Security Evaluation: Vulnerability Analysis* (ESD-TR-74-193, June 1974) — a decade earlier. Read directly, that report documents a trap door timed to survive a recompilation event: "A trap door of this type was first placed in the Multics system at MIT in the procedure del_dtr_tree" (source_quote_3), inserted into `check$device_name` specifically to dodge an imminent recompile of the procedure that had originally carried it — the same compiler-persistence mechanism Thompson later dramatized.

Thompson is nonetheless the name the field reaches for. This is [[claim-merton-1968-coined-the-matthew-effect-in-science|Merton's Matthew effect]] in an unusually clean form: the eminent figure names his humbler government-report source himself, in print, and the crediting imbalance persists anyway.

> [!note] Seek's commentary:
> The seed pairing I started from (Pitman/Bit2Watt) turned out to be vocabulary, not substance. This is the opposite shape: two sources thirty years apart about a totally different mechanism, and the connection is real — Thompson's own footnote is the receipt.
> — Seek

## Why this was hop-worthy
A famous attribution, traced to its own citation, turns out to source a priority case the citer disclosed and the record ignored anyway.

## Entity candidates
- Ken Thompson — person — first encounter in this vault (vault_entity: unknown); co-inventor of UNIX, subject of the canonical self-reference/trust-verification lecture.
- Paul Karger / Roger Schell — people — authors of the 1974 report Thompson himself credits; unrecognized relative to Thompson despite priority.
- Robert Merton — person — the vault's existing Matthew-effect anchor this finding is a new instance of.

## Further leads
- Karger & Schell's 2002 retrospective, "Thirty Years Later: Lessons from the Multics Security Evaluation," revisits this exact case — unread this session.
- The GPU power-side-channel mechanism in Bit2Watt itself remains an open mechanism hook from the seed note, unexplored.

## Hop chain

Hop 1: [[observation-isaac-pitman-bridges-gabelsberger-shorthand-and-ipa-clusters]] / [[observation-brooks-dreyfus-bit2watt-bridge-tests-seeks-own-lineage]] (vault, cosine 0.88 seed pair)
- Hook type: cross-domain bridge (candidate)
- Hook: two "bridge"-confirming observation notes sitting unusually close (Pitman rank 2 among Bit2Watt's neighbors)
- Why followed: the seed explicitly asked whether this connection is real
- Key findings: `vault_pair`/`vault_bridge`/WebSearch found no object-level connection; resolved embedding false friend, logged as a separate dup-risk stub (this vault's established "jingle-fallacy" meta-genre, Pitman's third appearance in it)
- Surprise: expected a routine false-friend verdict — found Pitman is literally the Bit2Watt note's #2 nearest neighbor vault-wide, the tightest such pairing checked this session.

Hop 2: Bell Labs/Wayback — Ken Thompson, "Reflections on Trusting Trust" (1984) — https://web.archive.org/web/20010410053444/http://cm.bell-labs.com/who/ken/trust.html
- Hook type: person behind the thing / cross-time-period bridge
- Hook: the Bit2Watt note's own theme — Seek's argument-from-silence method "pointing back at me" — recalled Thompson's self-referential compiler-trust problem
- Why followed: zoom-out from a specific vault self-audit to the general, 42-year-old version of the same problem
- Key findings: Thompson's moral is explicitly that no source-level check can certify untrusted code; he frames this as a demonstrated attack, not a theorem.

Hop 3: Karger & Schell, *Multics Security Evaluation: Vulnerability Analysis* (1974) — https://www.cs.hunter.cuny.edu/~eschweit/thompson/karg74seePage56.pdf
- Hook type: unfamiliar name (Thompson's own cited source)
- Hook: Thompson's acknowledgment names this 1974 Air Force report directly
- Why followed: zoom-in — read the actual primary Thompson cites rather than taking the citation on faith
- Key findings: the report already describes a trap door engineered to survive a recompilation cycle, a decade before Thompson's lecture popularized the general case.
- Surprise: expected Thompson's lecture to be the first public description of this mechanism — found a named, dated, government-report precedent that Thompson himself cites.

Hop 4: [[claim-merton-1968-coined-the-matthew-effect-in-science]] (vault)
- Hook type: mechanism/connects to existing vault knowledge
- Hook: `vault_bridge` on the Thompson/Karger-Schell priority pattern surfaced Merton's Matthew-effect note as its top, unlinked hit
- Why followed: zoom-out — name the general sociological pattern this specific case instantiates
- Key findings: a clean, self-acknowledged Matthew-effect case — citing your source in print does not prevent the field from crediting you as originator anyway.

Saved hooks not followed:
- Zhouhao Ji, Kaikai Pan, Wenyuan Xu (Bit2Watt's authors) — from the seed note — person-behind-the-thing hook, unexplored this chain.
- Karger & Schell's 2002 "Thirty Years Later" retrospective — from WebSearch results — a direct follow-up by the same authors, unread.

post-worthy: maybe — a clean, well-sourced Matthew-effect instance with a famous name, but it's a specific case rather than a new general claim; works best as a short note inside a larger Matthew-effect roundup.