If anyone is wondering why this has come up again, this was referenced by the US government during their proposed hack on xcode and the iOS SDK.<p>Leaked NSA discussion 'Strawhorse: Attacking the MacOS and iOS Software Development Kit': <a href="https://freesnowden.is/2015/03/10/strawhorse-attacking-the-macos-and-ios-software-development-kit/" rel="nofollow">https://freesnowden.is/2015/03/10/strawhorse-attacking-the-m...</a><p>Article: <a href="https://firstlook.org/theintercept/2015/03/10/ispy-cia-campaign-steal-apples-secrets/" rel="nofollow">https://firstlook.org/theintercept/2015/03/10/ispy-cia-campa...</a>
>I could have picked on any program-handling program such as an assembler, a loader, or even hardware microcode.<p>Prescient.<p>If I was a 3-letter surveillance agency with an unlimited budget, lots of gifted engineers, and significant legal leverage over the two largest players of the PC processor market via such instruments as National Security Letters, x86 microcode is exactly where I would hide backdoors.
(This comment originally posted: <a href="https://news.ycombinator.com/item?id=8023247" rel="nofollow">https://news.ycombinator.com/item?id=8023247</a> )<p>Please have a look at David A. Wheeler’s page on Trusting trust [1], including his 2009 PhD dissertation [2], where he clearly demonstrates that it is possible to have trusted (not in the MS sense...) computers (I think).<p>You may also be interested in 'Countering "Trusting Trust"' on Schneier's website [3], which discusses a 2006 paper, also by Wheeler.<p>[1] <a href="http://www.dwheeler.com/trusting-trust/" rel="nofollow">http://www.dwheeler.com/trusting-trust/</a><p>[2] <a href="http://www.dwheeler.com/trusting-trust/dissertation/html/whe.." rel="nofollow">http://www.dwheeler.com/trusting-trust/dissertation/html/whe...</a>.<p>[3] <a href="https://www.schneier.com/blog/archives/2006/01/countering_tr.." rel="nofollow">https://www.schneier.com/blog/archives/2006/01/countering_tr...</a>.
It is a classic - but also quite old - there are some new techniques for countering this: <a href="https://www.schneier.com/blog/archives/2006/01/countering_trus.html" rel="nofollow">https://www.schneier.com/blog/archives/2006/01/countering_tr...</a>