Code Complete gets into the idea that you want multiple testing methods since they tend to have complementary coverage Reducing bugs to the spec has the same b

Code Complete gets into the idea that you want multiple testing methods since they tend to have complementary coverage Reducing bugs to the spec has the same benefits as Rust reducing memory safety bugs to unsafe blocks & to your point: Spectre & Meltdown took decades for real world testing to unearth. So now that we know them, it'd be nice to come up with a formalization in the spec to address observable information leaks so that future chips have reduced attack surface in the space of spec implementations It's hard to prove you're safe from novel threats, but let's not let that stop us from proving we're safe from old tricks