Dear Mr. Ken Thompson,

 

When you delivered your 1983 Turing Award lecture — later published in Communications of the ACM in 1984 — I was a kid in grade school, sitting in front of an Atari 800 hooked up to a spare 13" black‑and‑white television, learning to think in terms of bits, bytes, and possibility. You were already a legend. I was just beginning.

​

And yet the problem you described that year — the “trusting trust” attack — would eventually become a problem I solved.

​

“You can’t trust code that you did not totally create yourself.”

​

You demonstrated that trust, once introduced into a compiler or toolchain, becomes a permanent, uninspectable dependency. A malicious semantic mutation can propagate invisibly across generations of binaries, immune to audits, rewrites, and inspection. You showed that trust is not merely fragile — it is architecturally unsound.

​

For decades, the field treated your conclusion as a law of nature.

​

But here is the part that changes the story:

​

I’ve solved the problem you identified.

Not by repairing trust.

Not by detecting subversion.

But by removing trust from the substrate entirely.

​

Event Correctness Engineering is built on a principle more radical than zero trust:

assume 100% hostility from everyone, everywhere, at all times — and design a system that still produces correct outcomes.

 

In this architecture:

• Every component is treated as adversarial by default.

• Every transformation must produce a correctness‑preserving proof of its own behavior.

• Every event must attach to a deterministic, cryptographically verifiable lineage.

• No subsystem is allowed to inherit semantics from an unprovable ancestor.

• No “trusted interior” is permitted anywhere — not in compilers, not in runtimes, not in infrastructure, not even in the environment.

​

This is not a security model.
This is a physics model for computation under total hostility.

​

And under these physics, the “trusting trust” attack is not mitigated —

it is rendered impossible.

 

Your Trojan compiler cannot exist, not because we detect it, but because the substrate forbids the category of behavior it relies on. A self‑reproducing semantic mutation cannot propagate if every transformation must prove its own correctness against an immutable, external event lineage.

​

You taught the world that trust is a one‑way valve.
I built a system where trust is not a variable in the equation.

​

Your lecture revealed a flaw in the foundations of computing.
My work replaces the foundation — with one that remains correct even when every participant is malicious.

​

Thank you for articulating the problem so clearly.
It made recognizing the significance of the solution that much easier.

​

Respectfully,

 

Douglas E. Fisher

Founder & Chief Architect, Zero Trust Event Systems

Founding Steward, Event Correctness Engineering