3 ms·
https://en.wikipedia.org/wiki/Rice%27s_theorem https://en.wikipedia.org/wiki/Rice%27s_theorem Thank you, that's the kind of example I was thinking must exist.
by motohagiography 6y ago
https://en.wikipedia.org/wiki/Rice%27s_theorem https://en.wikipedia.org/wiki/Rice%27s_theorem
Thank you, that's the kind of example I was thinking must exist. It implies there is a program for each system that is undecidable, and then the question becomes how many of those programs transfer control so that the program rewrites itself. Maybe we don't need to do this in security, but sometimes it feels like the whole field is predicated on denying some foundational truth about complexity.
- michaelt 6y agoIsn't the statement that "there exists a program for each system such that arbitrary code execution is possible" a tautology? Aren't you basically saying "Executing arbitrary code can allow executing arbitrary code"?
- motohagiography 6y agoTo a point, as there's no difference between authorized and unauthorized code, except there is, but there isn't.:) Maybe more like wondering what the consequences are if all code is arbitrary, particularly for higher order abstractions like security and economics. Security has always been a hall of mirrors, and a principle like this could be a fast heuristic for deciding how much risk you want to take. In all the security design work I've done, it was based on, "we've essentially made an attack cost greater than X, where X is close to the value of what they're protecting."