6 ms·

Once code is developed that proves to be bug free, it can be used over and over with no bugs! Doesn't seem to quite work like that in real life.

rtpg 9y ago
quicksort? cat? ls? I mean some of these things have bugs still, but generally when you have something of fixed scope then there are less bugs over time. Especially if you're restricting your scope to something simple
- onion2k 9y ago
  Those 3 examples that are both relatively simple and more than 40 years old are unlikely to convince people that something new and complex is worth the risk.
  - jacquesm 9y ago
    Unix is anything but simple. And 40 years ago they were actually able to convince people that this new thing was worth the risk and that's why we're having this conversation today. Early adopters are simply early, they will most likely lose their shirt but some of them will end up making you wish that you too were an early adopter. It's a bit like angel investing.
- seanwilson 9y ago
  > I mean some of these things have bugs still, but generally when you have something of fixed scope then there are less bugs over time. Especially if you're restricting your scope to something simple I'm guessing that smart contracts tend to be relatively short and simple? I mean I would never bet on an entire web/mobile app being bug free because the surface to attack is enormous but e.g. a sorting algorithm or something small in scope can be formally verified to be bug free as long as your specification is accurate.
- jakobegger 9y ago
  Very many implementations of quicksort are vulnerable to inputs that trigger quadratic runtime because of improper selection of the pivot element.
  - cesarb 9y ago
    Less well-known, not only is the selection of the pivot element important, but also the selection of which side you use recursion: "[...] it always recurses on the first sub-partition, and iterates on the second sub-partition; but instead, it should always recurse on the smaller sub-partition, and iterate on the larger sub-partition [...] our attack constructs an input array of N elements that causes qsort() to recurse N/4 times." https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt https://www.qualys.com/2017/06/19/stack-clash/stack-clash.tx... That's from last month.
jcoffland 9y ago
Are you saying there is no bug free code?

rtpg 9y ago

quicksort? cat? ls? I mean some of these things have bugs still, but generally when you have something of fixed scope then there are less bugs over time. Especially if you're restricting your scope to something simple

onion2k 9y ago
Those 3 examples that are both relatively simple and more than 40 years old are unlikely to convince people that something new and complex is worth the risk.
- jacquesm 9y ago
  Unix is anything but simple. And 40 years ago they were actually able to convince people that this new thing was worth the risk and that's why we're having this conversation today. Early adopters are simply early, they will most likely lose their shirt but some of them will end up making you wish that you too were an early adopter. It's a bit like angel investing.
seanwilson 9y ago
> I mean some of these things have bugs still, but generally when you have something of fixed scope then there are less bugs over time. Especially if you're restricting your scope to something simple I'm guessing that smart contracts tend to be relatively short and simple? I mean I would never bet on an entire web/mobile app being bug free because the surface to attack is enormous but e.g. a sorting algorithm or something small in scope can be formally verified to be bug free as long as your specification is accurate.
jakobegger 9y ago
Very many implementations of quicksort are vulnerable to inputs that trigger quadratic runtime because of improper selection of the pivot element.
- cesarb 9y ago
  Less well-known, not only is the selection of the pivot element important, but also the selection of which side you use recursion: "[...] it always recurses on the first sub-partition, and iterates on the second sub-partition; but instead, it should always recurse on the smaller sub-partition, and iterate on the larger sub-partition [...] our attack constructs an input array of N elements that causes qsort() to recurse N/4 times." https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt https://www.qualys.com/2017/06/19/stack-clash/stack-clash.tx... That's from last month.

jcoffland 9y ago

Are you saying there is no bug free code?