Trusting Trust in 2026

There’s a brief and delightful post by Casey Rodarmor on how the Rust compiler knows that ‘\n’ (a newline) in a string should be translated into 0x0A – despite that particular byte appearing nowhere in the source code. It turns out that, when you compile the Rust compiler (using an existing Rust compiler), the required translation is already baked into the compilation. No amount of effort to scrutinize the Rust compiler’s source code – even the very first version of the source! – would reveal that ‘\n’ compiles to 0x0A.

That post is a somewhat of a kōan on security; worth contemplating and understanding.

Supply-chain security risk management isn’t just about being able to inspect the source code. The exploit could already be baked into compilation, storage, and transmission.

Ken Thompson wrote in Reflections on Trusting Trust (1984) that it is practically impossible to trust code (including compilers, interpreters, HDL, and VMs) that you did not totally create yourself. “Perhaps it is more important to trust the people who wrote the software”. His illustration follows a similar, more deliberate exploit of the ‘\n’/0x0A pattern described above.

I find the shift in supply-chain risk with agentic coding (and agents in general) very interesting.

On the one hand, agentic coding is likely to reduce reliance on trivial dependencies – it’s now just easier to check whether a number is even yourself, which arguably lowers the risk of supply chain attacks. On the other hand, the LLM itself, its agentic harness, and all of the organic inputs that it consumes become new attack vectors that we are only beginning to understand.

Be careful out there.