3 ms·
Simplicity in algorithm affords more capacity for studying implementation. Bugs are easier to find, even through very simple, automated fuzzing procedures, let
by mc4ndr3 5y ago
Simplicity in algorithm affords more capacity for studying implementation. Bugs are easier to find, even through very simple, automated fuzzing procedures, let alone formal verification.
Bugs scale in frequency according to total source line count. Don't expect professionals to write perfect code, especially as complexity grows.
Simplicity of algorithm is critical for peer review of the implementation, as the pool of reviewers is incredibly small. It's one thing to prefer community vetted implementations, but the implementation cannot be blindly trusted by everyone--that would be involve the logical fallacy of an appeal to authority.
- throwaway81523 5y agoWe're not talking about code bugs per se (program computes something different from what you intended). It's more like mathematical errors: you correctly compute what you intended to, but that turns out to be insecure for subtle reasons. Padding oracle attacks are an example that the article spent some time on.
- tedunangst 5y ago20 years of RSA vulnerabilities and all they needed to do is fuzz it first!
- afiori 5y agoAs the saying goes: simple and easy are very different.