AFAIK the only group to discover Ken’s hack was us in PWB/UNIX. One of the other guys noticed C prepreprocessor had gotten bigger, looked at binary namelist, found symbol not in source code. I got onto Ken’s system, found the code, very clever.

@mattblaze A bit latet, I was in Lab 127’s terminal room, talking to dmr or bwk, and overheard amusing conversation between ken and Robert Morris Sr, who sometimes consulted for NSA.
(RM Jr of worm fame was just a kid then.)
@mattblaze They were chortling away over cleverness of exploit. Then one (must have been ken) said “think we could put this over on NSA?” (which already had UNIX systems... we did favors now and then).
More chortling, then (must have been Bob): uhh, NSA really doesn’t have sense of humor.
@mattblaze PWB crew ran 1st real UNIX computer center & we were hyper-sensitive, partly because someone had called at night, told operator he was Ken Thompson & needed root password ... and got it. Turned out to be high schooler ... proving that social engineering tactics have been eternal.
@mattblaze Years later, as many BTL Directors were buying PDP11-70s for labs as general service systems, some PWB crew were asked to do security audits, given experience running biggest UNIX site. One lab was very proud of enhanced password software.
We did audit, agreed with that, BUT:
@mattblaze We told them, unfortunately:
1) Many terminals had yellow stickies with root password.
2) They’d reused unused lab space w/o adequate HVAC, room got hot, so they often left door open.
As usual, good tech helps, but human error/laziness must always be guarded against.
@mattblaze BTL Directors could spend $250K w/o much approval, enough to buy PDP 11/70, disks, tapes, run their own computer center w/o having to negotiate with regular BTL computer centers.
Same thing happened later with workstations & then PCs: user depts got impatient with central IT.
@mattblaze There's often been pendulum swing between centralized & distributed IT handling.
Just as happened later with workstations/PCs, BTL Directors found that running own computer center well was a pain. The main computer centers then offered to do facilities management, with good HVAC,
@mattblaze 24-hour operators who could run tape backups, and centralized purchasing. If a Director wanted more disk space for their system(s), they just told central IT, not have to haggle over disk allocation.
I recall centralized mainframe service bureaus of 1960s,reborrn as cloud🙂

More from Software

The Great Software Stagnation is real, but we have to understand it to fight it. The CAUSE of the TGSS is not "teh interwebs". The cause is the "direct manipulation" paradigm : the "worst idea in computer science" \1


Progress in CS comes from discovering ever more abstract and expressive languages to tell the computer to do something. But replacing "tell the computer to do something in language" with "do it yourself using these gestures" halts that progress. \2

Stagnation started in the 1970s after the first GUIs were invented. Every genre of software that gives users a "friendly" GUI interface, effectively freezes progress at that level of abstraction / expressivity. Because we can never abandon old direct manipulation metaphors \3

The 1990s were simply the point when most people in the world finally got access to a personal computer with a GUI. So that's where we see most of the ideas frozen. \4

It's no surprise that the improvements @jonathoda cites, that are still taking place are improvements in textual representation : \5
As the year wrap's up, let's run through some of the worst public security mistakes and delays in fixes by AWS in 2020. A thread.

First, that time when an AWS employee posted confidential AWS customer information including including AWS access keys for those customer accounts to


Discovery by @SpenGietz that you can disable CloudTrail without triggering GuardDuty by using cloudtrail:PutEventSelectors to filter all events.


Amazon launched their bug bounty, but specifically excluded AWS, which has no bug bounty.


Repeated, over and over again examples of AWS having no change control over their Managed IAM policies, including the mistaken release of CheesepuffsServiceRolePolicy, AWSServiceRoleForThorInternalDevPolicy, AWSCodeArtifactReadOnlyAccess.json, AmazonCirrusGammaRoleForInstaller.

You May Also Like

Trump is gonna let the Mueller investigation end all on it's own. It's obvious. All the hysteria of the past 2 weeks about his supposed impending firing of Mueller was a distraction. He was never going to fire Mueller and he's not going to


Mueller's officially end his investigation all on his own and he's gonna say he found no evidence of Trump campaign/Russian collusion during the 2016 election.

Democrats & DNC Media are going to LITERALLY have nothing coherent to say in response to that.

Mueller's team was 100% partisan.

That's why it's brilliant. NOBODY will be able to claim this team of partisan Democrats didn't go the EXTRA 20 MILES looking for ANY evidence they could find of Trump campaign/Russian collusion during the 2016 election

They looked high.

They looked low.

They looked underneath every rock, behind every tree, into every bush.

And they found...NOTHING.

Those saying Mueller will file obstruction charges against Trump: laughable.

What documents did Trump tell the Mueller team it couldn't have? What witnesses were withheld and never interviewed?

THERE WEREN'T ANY.

Mueller got full 100% cooperation as the record will show.