News for hackers. Stuff that matters.
Re:Formal Verification Creates Hacker-Proof Code by nickpsecurity on Friday October 21, 2016 @07:04PM (#12765674)
Good write-up. I hear you about the patterns of debate that prop up in these threads. My favorites are the ones where people show up with specific logics, techs, or R&D suggestions that others and I learn from. Such an approach might lead to people solving hard problems over time.

My favorite counter to the Godel thing, esp about termination, was sklogic showing how far from reality these concerns were by illustrating that a while loop counting down toward zero with "stop if zero" condition will guarantee a termination of any algorithm working piece-by-piece in inner loop so long as hardware functions. No magic math at all required to defeat the termination requirement in real-world. I added watchdog timers or even shelf-life of modern parts can do the same.

I did something similar when I was concerned about infinite loops or DOS attacks from malicious input. Just box it up in something I know will work with something checking up on it. Another was algorithm theory telling me QuickSort performed better but choose HeapSort if worst-case is a problem. A smarter programmer told me to just time average for QuickSort, run it with a watchdog, kill it on any instance it takes too long, and use HeapSort for that instance. Those are the kind of tips I appreciate about these terrible problems the theoretical side brings me. Hell, if only theory people would find, generalize, and expand on all the effective cheats in engineering instead of idealistic or abstract stuff. :)

Re:Formal Verification Creates Hacker-Proof Code by simondedalus on Friday October 21, 2016 @09:47PM (#12766558)
But doesn't the constant Gödel reference push people, exactly, to work toward effective cheats? Imagine if the people putting in effort to make real systems instead spent their time trying to create the self-verifying prover.
Re:Formal Verification Creates Hacker-Proof Code by nickpsecurity on Friday October 21, 2016 @10:18PM (#12766697)
No it distracts people by making them think some legend in math showed verification was provably a waste of time. The number that show up to keep saying it on reputable forums like this one leads to increased belief it's true via repetition effect. So, it's overall bad vs mentioning something relevant to practical verifications.

Plus, hardly anyone is making a self-verifying prover. Someone just asked about that. I tried what I hope is the proper response of simply linking to a self-verifying prover that succeeded in that goal up to first-order logic. So, that's already done with us just needing similar ones for checkers of HOL, Coq, ACL2, etc. Contrary to your implication, the Milawa techniques are based on and supporting some of most practical verification work to ever be done. So, one of few times someone totally ignored Godel in what non-experts would consider Godel's domain led to one of best results in formal methods.

We don't need Godel at all in these discussions. We just need to explain what formal methods are, their successes, their limitations, how to properly use them, and ideas for new projects.