4 ms·
A lot of this is predicated on the practicality of writing contracts in conventional code, so let's talk about the state of writing "bug free systems," and the
by lpage 10y ago
A lot of this is predicated on the practicality of writing contracts in conventional code, so let's talk about the state of writing "bug free systems," and the cost. In some cases, there are options that come pretty close. All have huge trade offs and drawbacks.
Model checkers work. You can, with effort, prove programs correct. This works very well for small programs but grows exponentially more complex in the number of branches and variable constraints. Even if you had the computational power you'll quickly hit an inflection point where you're as likely to have a bug in your proof as you are the underlying code.
Life-critical systems style code review works. NASA is very good at writing bug-free C code via a style guide that subsets the language, static analysis/formal methods, and a review process that makes waterfall look agile.
Voing works. In aerospace, code that's responsible for controlling actuators and surfaces is often implemented in three different ways, driving three different actuators. If one implementation returns a different result, majority wins. Same principle for other applications - the output need not be an actuation.
The biggest problem isn't that bug free system are a pipe dream - it's that making one is very expensive, and the cost grows massively as your tolerance for error decreases. This is a community that wants to drive adoption, and that means competing with the status quo. If one of your selling points is that you're saving the cost and complexity of dispute resolution and human constructs, you've gotta factor in the cost of writing bug free contracts in the first place.
- zenogais 10y agoYou're also talking about systems 20,000x larger than what The DAO contract was [1]. The total DAO contract is roughly 2,000 LOC by my estimate [2]. IMO it probably won't be overly onerous to develop reliable contracts of this size using many of these techniques. It's just so few people have the discipline to delay implementation for design and planning at the level required when it needs to be bug free. Most software developers have no training in how to even begin designing and developing using these techniques. [1]: Shuttle's primary flight software contains 400,000 LOC http://www.nasa.gov/mission_pages/shuttle/flyout/flyfeature_shuttlecomputers.html http://www.nasa.gov/mission_pages/shuttle/flyout/flyfeature_... [2]: https://github.com/slockit/DAO https://github.com/slockit/DAO
- egd 10y ago> You're also talking about systems 20,000x larger than what The DAO contract was [1]. It sounds like the contract was underspecified. In my experience, the basic core logic of a system's usually a pretty small part of the overall codebase - the edge cases and error handling tend to be the bulk of the code. This tends to be the case in legal contracts, too - 100 pages of boilerplate to make sure the two pages of contract are air-tight.