Ask HN: What are the fundamental “must read” papers on software security

Here's a few to kick it off:

Ken Thompson - Reflections on Trusting Trust (1984): https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf

Whitfield Diffie and Martin E. Hellman - New Directions in Cryptography (1976): https://www.cs.utexas.edu/~shmat/courses/cs380s/dh.pdf (not strictly software security but still a fantastic & important read)

Dan Bernstein - Some thoughts on security after ten years of qmail 1.0 (2007): https://cr.yp.to/qmail/qmailsec-20071101.pdf