This is part of a comment I made on The State of State Machines (2021) [1] which is a Google Project Zero post about how complex state machines were exploited.

This is part of a comment I made on The State of State Machines (2021) [1] which is a Google Project Zero post about how complex state machines were exploited. > I feel like we will continue to run into these kinds of issues to the end of time unless can figure out: 1. How to precisely describe the properties we want the final system to have, 2. How to 'compile' from a higher-level language/layer into a lower-level language while maintaining all those properties. At the least this will require us to: 3. Define the precise semantics of each layer and enforce that every construction in and implementation of that layer adheres to it strictly. > Layers/languages should verifiably maintain these properties through every translation via paths like: eula/privacy policy, requirements, UX, UI, state machine, source code, AST, IR, ASM, machine code. Every one of these layers should have a well-defined execution model that is isomorphic with other layers, modulo metadata. For example: source code === AST [+ comment/whitespace/filesystem metadata], AST === IR [+ name/desugaring/applied-optimizations metadata]. All undefined behavior at every layer must be exterminated by definition or avoided by construction. [1]: https://news.ycombinator.com/item?id=25836398#25838252 https://news.ycombinator.com/item?id=25836398#25838252