5 ms·

That may all be true, but it doesn't change the fact that the code is written in a style that has proven to be almost totally immune to proper verification of a

That may all be true, but it doesn't change the fact that the code is written in a style that has proven to be almost totally immune to proper verification of any kind. That being the case, and regardless of the soundness or utility of the underlying science or mathematical modelling, you don't know if it works. You can't. Neither can I. Neither can the people who wrote it, or the people relying on their advice. Any arguments that the developers of this code are somehow above needing to mechanically test, or formally verify, or independently peer review the code to ensure quality are trivially debunked by the history of bug fixes and changes in behaviour that we do know about, even before making any judgements based on the apparent attempts to hide that history and to conceal the original code from before they brought in programming experts to help tidy it up. If you have indeed been an expert witness doing code reviews, are you seriously contending that you would not annihilate any case made in a court that hinged on the results of code like this?

matthewdgreen 6y ago
As an expert witness, I would be expected to present evidence that the code is wrong in a way that produces scientifically-invalid output. If instead I produced a bunch of nonsense about how the code would be in my opinion more efficient if it ran on multiple cores, that would be strong evidence that I failed in my task and was blowing smoke to cover it up.
- VMG 6y ago
  Is there any evidence that the code produces scientifically-valid output?
  - matthewdgreen 6y ago
    You're asking a scientific question. To answer it you'd need to do difficult things like read scientific papers, understand epidemiology well enough to determine whether their models made sense, check their past outputs against real epidemic outcomes (accounting for the fact that national policy changes really matter). In short, you'd have to do exactly what the scientific community does all day, not just glance at some software and make loud claims. This is much more difficult than reading a Git issue tracker, so obviously the critics have nothing to offer us here.
    - rpdillon 6y ago
      I don't claim any expertise at all, but without documentation and tests (both of which are called out as largely missing for this codebase), how can the expert epidemiologists tell if the software is behaving correctly?
      - matthewdgreen 6y ago
        I presume they run it many times and compare the final and intermediate outputs to reality, then adjust parameters and see how it performs under those parameters. And other models do similar things and compare to you. There are hundreds of papers on Google Scholar about epidemic simulation. This isn't an area where your performance is going to be determined by a few unit tests.
        rpdillon 6y ago
        So the argument is that determining the correctness of the simulation is so complex that any kind of automated tests won't matter. The rebuttal makes a couple of statements about how scientists spend their time to verify their work: > Scientific software tends to be validated in a more ad hoc way. This is a domain-specific norm, not a matter of competence. > Practically every scientist I know spends most of their time checking their results rather than coding, and I sincerely doubt that the Imperial group is any different. I wonder if the team could iterate more quickly if some of these ad hoc validations were automated.
    - Silhouette 6y ago
      You're asking a scientific question. But it's not just a science question. That is the point of the criticism. Assuming you are the Matthew D Green known for his cryptography work, surely you of all people understand that a poor implementation can have profound consequences even if the original mathematics is sound?
      - matthewdgreen 6y ago
        I am, and I've written both production and non-production software. I know that every piece of software has limited development resources, and has different demands on those resources. We're in the midst of a pandemic right now and demands are particularly acute for fresh simulation data, with simulation parameters changing constantly based on new information and policy proposals. So what do you do with your limited resources? Do you tell the government you can't get them any preliminary data because your multithreading system doesn't work, and you need four months to refactor the code (even though you could just run single-core)? Do you tell them that because you have to write a complete unit testing framework, you can't give them any modeling data or update your model parameters, sorry, good luck with everything. Do you tell them that another 30K people may have to die based on wrong policy choices because you have decided to prioritize "shipping-production-quality" software standards, even though you are not shipping your software? You can pretend that this is not a trolley problem. But in this case it literally is. You are standing at the switch in the tracks, and on one side is a detailed set of unit tests and multi-core support, and on the other hand might be tens of thousands of living people. And you know your code better than anyone else in the world. What do you choose? I don't have an answer. I'm saying the answer is hard, and we're not equipped to lay claims on it based on glancing at a Git repo.
- Silhouette 6y ago
  The most worrying thing about your reply is probably the premise that the burden of proof would be on you to prove it materially incorrect, and not on those advocating policy based on it to prove that it had any scientific value in the first place. If obfuscating code to the point where it could be doing just about anything but it's so difficult to understand that no-one can positively prove it's doing something wrong is a viable strategy, the system is broken a priori.
- thu2111 6y ago
  What evidence would you accept? The code has multiple memory safety bugs and a broken random number generator. You don't seem to think that makes the results scientifically invalid output, which is bizarre.

matthewdgreen 6y ago

As an expert witness, I would be expected to present evidence that the code is wrong in a way that produces scientifically-invalid output. If instead I produced a bunch of nonsense about how the code would be in my opinion more efficient if it ran on multiple cores, that would be strong evidence that I failed in my task and was blowing smoke to cover it up.

VMG 6y ago
Is there any evidence that the code produces scientifically-valid output?
- matthewdgreen 6y ago
  You're asking a scientific question. To answer it you'd need to do difficult things like read scientific papers, understand epidemiology well enough to determine whether their models made sense, check their past outputs against real epidemic outcomes (accounting for the fact that national policy changes really matter). In short, you'd have to do exactly what the scientific community does all day, not just glance at some software and make loud claims. This is much more difficult than reading a Git issue tracker, so obviously the critics have nothing to offer us here.
  - rpdillon 6y ago
    I don't claim any expertise at all, but without documentation and tests (both of which are called out as largely missing for this codebase), how can the expert epidemiologists tell if the software is behaving correctly?
    - matthewdgreen 6y ago
      I presume they run it many times and compare the final and intermediate outputs to reality, then adjust parameters and see how it performs under those parameters. And other models do similar things and compare to you. There are hundreds of papers on Google Scholar about epidemic simulation. This isn't an area where your performance is going to be determined by a few unit tests.
      - rpdillon 6y ago
        So the argument is that determining the correctness of the simulation is so complex that any kind of automated tests won't matter. The rebuttal makes a couple of statements about how scientists spend their time to verify their work: > Scientific software tends to be validated in a more ad hoc way. This is a domain-specific norm, not a matter of competence. > Practically every scientist I know spends most of their time checking their results rather than coding, and I sincerely doubt that the Imperial group is any different. I wonder if the team could iterate more quickly if some of these ad hoc validations were automated.
  - Silhouette 6y ago
    You're asking a scientific question. But it's not just a science question. That is the point of the criticism. Assuming you are the Matthew D Green known for his cryptography work, surely you of all people understand that a poor implementation can have profound consequences even if the original mathematics is sound?
    - matthewdgreen 6y ago
      I am, and I've written both production and non-production software. I know that every piece of software has limited development resources, and has different demands on those resources. We're in the midst of a pandemic right now and demands are particularly acute for fresh simulation data, with simulation parameters changing constantly based on new information and policy proposals. So what do you do with your limited resources? Do you tell the government you can't get them any preliminary data because your multithreading system doesn't work, and you need four months to refactor the code (even though you could just run single-core)? Do you tell them that because you have to write a complete unit testing framework, you can't give them any modeling data or update your model parameters, sorry, good luck with everything. Do you tell them that another 30K people may have to die based on wrong policy choices because you have decided to prioritize "shipping-production-quality" software standards, even though you are not shipping your software? You can pretend that this is not a trolley problem. But in this case it literally is. You are standing at the switch in the tracks, and on one side is a detailed set of unit tests and multi-core support, and on the other hand might be tens of thousands of living people. And you know your code better than anyone else in the world. What do you choose? I don't have an answer. I'm saying the answer is hard, and we're not equipped to lay claims on it based on glancing at a Git repo.
Silhouette 6y ago
The most worrying thing about your reply is probably the premise that the burden of proof would be on you to prove it materially incorrect, and not on those advocating policy based on it to prove that it had any scientific value in the first place. If obfuscating code to the point where it could be doing just about anything but it's so difficult to understand that no-one can positively prove it's doing something wrong is a viable strategy, the system is broken a priori.
thu2111 6y ago
What evidence would you accept? The code has multiple memory safety bugs and a broken random number generator. You don't seem to think that makes the results scientifically invalid output, which is bizarre.