Running the “Reflections on Trusting Trust” Compiler

Revisiting Ken Thompson’s sourceless backdoor

This article revisits that backdoored compiler, presenting the original code Thompson wrote more than 50 years ago.

queue.acm.org/detail.cfm?i...

Kode Vicious:
Driven to Distraction
From floats to characters and back again

50 years of doing things the Unix way has left us bereft of better APIs. It's not just the drivers but also the application APIs on top of the operating system.
queue.acm.org/detail.cfm?i...

Operations and Life:
#SRE Is Anti-Transactional

An API for interfacing with automaters

Systems built by SREs are not fully autonomous on day one. It's iteration over time that leads to fully autonomous, functional, reliable service.

queue.acm.org/detail.cfm?i...

@yesthattom.bsky.social

A Practical Guide to Transitioning to Memory-Safe Languages

Turning off the spigot of vulnerabilities: a new strategy for memory safety

Traditional approaches to memory safety are flawed, treating symptoms without addressing the underlying cause.

queue.acm.org/detail.cfm?i...

@ayper.bsky.social

Practical #Security in Production

Hardening the C++ Standard Library at massive scale

Our collective experience at Apple and Google demonstrates that significant safety gains are achievable with surprisingly minimal performance overhead in production environments

queue.acm.org/detail.cfm?i...

Safe Coding

Rigorous modular reasoning about software safety

Safe coding embodies a modular, compositional approach to building and reasoning about the safety of large, complex systems.

queue.acm.org/detail.cfm?i...

Memory Safety for Skeptics

If you're tired of hearing about memory safety, this article is for you.

The state of possibility with memory safety today is similar to the state of automobile safety just prior to the widespread adoption of mandatory seat-belt laws.

queue.acm.org/detail.cfm?i...

Kode Vicious
The Process: From start to finish

While the Scientific Method gives us a way to evaluate a hypothesis, a Scientific Process allows us to organize our minds to form these hypotheses, lay out a piece of code, organize a project, or debug a program.

queue.acm.org/detail.cfm?i...

Operations and Life

No One Has Time to Work on Your Project

queue.acm.org/detail.cfm?i...

What if you could apply a few basic principles that would help make working on your project seem more attractive and worthwhile? How to work effectively with overwhelmed people to get things done

Moving Faster by Not Breaking Things:
Or How Not to Blow Up the Internet

People slow down when they are afraid, and they are afraid when they don't know the consequences of their actions. Initial investments allow for a fearless approach to pushing changes.

queue.acm.org/detail.cfm?i...

Guardians of the Agents
Formal verification of AI workflows

This proof-based approach addresses problems by providing deterministic and verifiable assurances of safety without the need to trust the AI nor any of the artifacts it produces

queue.acm.org/detail.cfm?i...

Unsolved Problems in #MLOps

The practitioners whose job it is to make AI work are scrambling behind the scenes, often more in dread than excitement. Either find a better paradigm or fix the ones we're using now.

queue.acm.org/detail.cfm?i...

Understanding the Harm Teens Experience on Social Media: A systematic approach to mitigating negative experiences online

Every day, millions of kids are having preventable harmful experiences on social media

queue.acm.org/detail.cfm?i...

Kode Vicious
In Search of Quietude

Unless you're writing only for yourself, whatever software you build will need to work with what others are building. So, the meta question is: "How much communication is required?"

queue.acm.org/detail.cfm?i...

Security Is Part of Every Critical User Journey

How else would you make sure that product security decisions serve your customers?

Raise your hand and propose that security outcomes and risks be defined at each step along critical user journeys.

queue.acm.org/detail.cfm?i...

Unleashing the Power of End-User Programmable AI

The design of an AI-first, program-synthesis framework built around a new language, Universalis, designed for workers to read, the computer to execute, and ready to be analyzed and manipulated

queue.acm.org/detail.cfm?i...

Concurrency in #WebAssembly

Experiments in the web and beyond

We discuss how concurrent programs are compiled to #Wasm today given the limitations of multi-core concurrency support, and also discuss further expanding Wasm's concurrency capabilities

queue.acm.org/detail.cfm?i...

When Is WebAssembly Going to Get DOM Support?
Or, how I learned to stop worrying and love glue code

Can I build my C#/Go/Python library/app into my website so it runs with good performance?

queue.acm.org/detail.cfm?i...

WebAssembly: How Low Can a Bytecode Go?:
New performance and capabilities

Wasm is still growing with new features to address performance gaps. With many languages and many targets, Wasm could one day become the universal execution format for compiled applications.

queue.acm.org/detail.cfm?i...

#WebAssembly: Yes, but for What?

WebAssembly has found a niche but not yet filled its habitable space. We look at #Wasm wins and losses, identify patterns, and extract commonalities. From those, we predict the future.

queue.acm.org/detail.cfm?i...

@wingolog.org

Research for Practice:
The Point is Addressing

Even something as innocent as addressing comes from a rich design space filled with tradeoffs between important considerations such as scaling, transparency, overhead, and programmer control.

queue.acm.org/detail.cfm?i...

AI: It's All About Inference Now

Model inference has become the critical driver for model performance.

Test-time compute scaling offers a new, exciting avenue to increase model performance beyond what can be achieved with training

queue.acm.org/detail.cfm?i...

Develop, Deploy, Operate

A holistic model for understanding the costs and value of software development:
- Tensions between factors
- 4 distinct forms of impact
- Warning against measuring against unknown counterfactuals
- Consensus mechanism for estimating DDR costs.

queue.acm.org/detail.cfm?i...

Generative AI at the Edge:
Challenges and Opportunities

We will soon see embodied, federated, and cooperative models become commonplace, enhancing our lives in the background. However, these models won't just compute; they will communicate, create, and adapt.

queue.acm.org/detail.cfm?i...

The Soft Side of Software:
Peer Mentoring

Stop waiting for a senior mentor to appear. Your peers are some of the most valuable mentors you'll ever find. Leverage those relationships, share insights, and bring value to every conversation.

queue.acm.org/detail.cfm?i...

Kode Vicious:
Can't We Have Nice Things?
Careful crafting and the longevity of code

We build apparatus to show some effect. This is how empiricists operate. They have a hunch, build an apparatus, run an experiment, refine the hunch, and then wash, rinse, and repeat.

queue.acm.org/detail.cfm?i...

Drill Bits
Sandboxing: Foolproof Boundaries vs. Unbounded Foolishness

Sandboxing mitigates risks of software so large, it's likely to harbor security vulnerabilities

To safely harness useful yet opaque libraries, a simple mechanism provides confinement—or does it?

queue.acm.org/detail.cfm?i...

Operations and Life
A Clean Approach to Process Optimization

My soap-loading technique isn't revolutionary, but it demonstrates process design: You can eliminate delays in starting a process by front-loading tasks whenever possible.

queue.acm.org/detail.cfm?i...
@yesthattom.bsky.social

Kode Vicious
Analyzing Krazy Kode

Code communicates our intentions to other humans. Code, like prose, has style and color and subtlety. When you open a function and start reading, try to think, "How do I feel about reading this."

queue.acm.org/detail.cfm?i...

From Function Frustrations to Framework Flexibility

Fixing tool calls with indirection

The principle of indirection can be applied to introduce a paradigm shift: replacing direct value manipulation with symbolic reasoning using named variables.

queue.acm.org/detail.cfm?i...