5 ms·

TigerBeetle is a beautiful example of why correctness is what we should strive for, instead of hyper-focusing on (and settling for) memory safety. The design d

TigerBeetle is a beautiful example of why correctness is what we should strive for, instead of hyper-focusing on (and settling for) memory safety. The design document shows the types of faults they aim to cover: https://github.com/tigerbeetledb/tigerbeetle/blob/main/docs/DESIGN.md https://github.com/tigerbeetledb/tigerbeetle/blob/main/docs/... And here you can see the safety section in their style guide: https://github.com/tigerbeetledb/tigerbeetle/blob/main/docs/TIGER_STYLE.md#safety https://github.com/tigerbeetledb/tigerbeetle/blob/main/docs/...

kristoff_it 4y ago
...and there's also an open bug bounty so if you think that Zig is not a meaningful improvement over C in terms of safety, it's certainly going to be easy money for you :^) https://github.com/tigerbeetledb/viewstamped-replication-made-famous https://github.com/tigerbeetledb/viewstamped-replication-mad...
- ipaddr 4y ago
  Look at the list of things you can't submit. Excludes: reconfiguration protocol, snapshot, recovery protocol. Todo items, things they know about but can't/won't fix. Excludes any kind of security issue. Easy money it is not but this bounty program doesn't mean what you think it does.
  - kristoff_it 4y ago
    Seems to me that memory safety bugs (eg UAF) can be reported as they would certainly impact correctness.
    - BiteCode_dev 4y ago
      If you work for one month and you are at the mercy of the other party to decide if they need to pay you, it's not any more easy money than the lottery.
      - _vvhw 4y ago
        I've definitely been there! Finding P1s for full read/write access and then seeing the report downgraded to a P3, and having to have the platform arbitrate and bump it back to P1. However, it was this experience of mine as a part-time security researcher that actually led to us creating the bug bounty program for TigerBeetle's consensus. For example, if you're looking at another database and find a correctness bug, there might not be a bounty program at all. Whereas with TigerBeetle, there hasn't been a single valid report that we haven't awarded, at least so far. It's also why we were careful to rather be upfront and explicit about scope, than disappoint anyone after the fact. And we recognize that consensus is hard and takes time to learn, hence the $8192 award for correctness finds. That said, I hope you can see from the leaderboard that we've been generous. For example, Alex Miller found a bug in Apple's O_DSYNC and we nevertheless awarded $1024 because it was such a great find (Apple thought so too!).
        BiteCode_dev 4y ago
        $1024 is half my daily rate. I doubt someone find "a great find" in 4 hours. And not even time that is guaranteed to be paid.
        _vvhw 4y ago
        To be clear, this was out of scope of the bounty, it was a bug in Apple, that TB awarded anyway.
        true_religion 4y ago
        I think they are pretty open about what they can afford to pay. If you have self selected to be worth $2000 a day due to expertise or necessity, then you know that you're not a good fit for them. However many people are willing to put in the work, so why are you so critical of their program. Do you think they are taking advantage of people who should charge more? Or do you think they will not get anyone good for such a low rate, and thus fool themselves into thinking they are secure?
    - _vvhw 4y ago
      100%
  - _vvhw 4y ago
    And yet there's so much that is there! The Normal protocol. The View Change protocol. The CTRL protocol from PAR (that you don't get to see often). Thousands of lines of code that are incredibly hard to get right. All the fault models. The storage fault model alone is also not something you find many distributed systems attempting, let alone paying bounties for. It's also not common to find bounties that go out of their way to help you. TigerBeetle's bounty ships with a state of the art Deterministic Simulation fuzzing tool that you can use to explore interesting state spaces quicker. It will even classify bugs as liveness or correctness for you. It's like your own Jepsen, except you can inject storage faults, speed up time, and replay anything you find from a seed. Again, the only reason we were explicit about scope really, is because of our own experience doing bounty programs that were underspecified. For example, while it should be clear enough that this is a distributed systems and consensus bug bounty challenge, literally called “Viewstamped Replication Made Famous”, we didn't want anyone to be confused and think it was a security bug bounty. That's the only reason it's excluded, because we want people to break our consensus. Nevertheless, we do have small awards for interesting findings. So I hope you'll give it a shot! We'd love to announce and award your findings. For example, why not take on the challenge during HYTRADBOI's database jam? https://www.hytradboi.com/jam https://www.hytradboi.com/jam
- tialaramex 4y ago
  This involves a serious, perhaps even fatal, misunderstanding. It was not impossible to write safe C. That's sort of ironically illustrated by WUFFS. WUFFS-the-library is literally C source code. C source code for a safe, very high performance data processing library. A human could have written that library in C. But they didn't, humans wrote that software in WUFFS-the-language and the tool which turned that into C to produce WUFFS-the-library. So, this bounty can't do what you claim. The existence of TigerBeetle, apparently high quality software written in Zig, doesn't mean somehow Zig is how you produce high quality software, any more than the fact somebody beat a Dark Souls game with a guitar controller means the guitar controller makes Dark Souls easier to beat.
  - avgcorrection 4y ago
    And the highest-level, most safe language can be compiled to machine code... you are not proving anything at all. Everyone already understands how compilers work. So they don’t care that Brainfuck can in principle (although not in practice) be written perfectly by people.
avgcorrection 4y ago
Who or what hyper-focuses on memory safety? (And settles for it?) Pray tell, what could the Zig VP of community be alluding to out of the blue without any prompt whatsoever?
- kristoff_it 4y ago
  Just read any other HN Zig thread and you will find an easy answer to your question :^)

kristoff_it 4y ago

...and there's also an open bug bounty so if you think that Zig is not a meaningful improvement over C in terms of safety, it's certainly going to be easy money for you :^) https://github.com/tigerbeetledb/viewstamped-replication-made-famous https://github.com/tigerbeetledb/viewstamped-replication-mad...

ipaddr 4y ago
Look at the list of things you can't submit. Excludes: reconfiguration protocol, snapshot, recovery protocol. Todo items, things they know about but can't/won't fix. Excludes any kind of security issue. Easy money it is not but this bounty program doesn't mean what you think it does.
- kristoff_it 4y ago
  Seems to me that memory safety bugs (eg UAF) can be reported as they would certainly impact correctness.
  - BiteCode_dev 4y ago
    If you work for one month and you are at the mercy of the other party to decide if they need to pay you, it's not any more easy money than the lottery.
    - _vvhw 4y ago
      I've definitely been there! Finding P1s for full read/write access and then seeing the report downgraded to a P3, and having to have the platform arbitrate and bump it back to P1. However, it was this experience of mine as a part-time security researcher that actually led to us creating the bug bounty program for TigerBeetle's consensus. For example, if you're looking at another database and find a correctness bug, there might not be a bounty program at all. Whereas with TigerBeetle, there hasn't been a single valid report that we haven't awarded, at least so far. It's also why we were careful to rather be upfront and explicit about scope, than disappoint anyone after the fact. And we recognize that consensus is hard and takes time to learn, hence the $8192 award for correctness finds. That said, I hope you can see from the leaderboard that we've been generous. For example, Alex Miller found a bug in Apple's O_DSYNC and we nevertheless awarded $1024 because it was such a great find (Apple thought so too!).
      - BiteCode_dev 4y ago
        $1024 is half my daily rate. I doubt someone find "a great find" in 4 hours. And not even time that is guaranteed to be paid.
        _vvhw 4y ago
        To be clear, this was out of scope of the bounty, it was a bug in Apple, that TB awarded anyway.
        true_religion 4y ago
        I think they are pretty open about what they can afford to pay. If you have self selected to be worth $2000 a day due to expertise or necessity, then you know that you're not a good fit for them. However many people are willing to put in the work, so why are you so critical of their program. Do you think they are taking advantage of people who should charge more? Or do you think they will not get anyone good for such a low rate, and thus fool themselves into thinking they are secure?
  - _vvhw 4y ago
    100%
- _vvhw 4y ago
  And yet there's so much that is there! The Normal protocol. The View Change protocol. The CTRL protocol from PAR (that you don't get to see often). Thousands of lines of code that are incredibly hard to get right. All the fault models. The storage fault model alone is also not something you find many distributed systems attempting, let alone paying bounties for. It's also not common to find bounties that go out of their way to help you. TigerBeetle's bounty ships with a state of the art Deterministic Simulation fuzzing tool that you can use to explore interesting state spaces quicker. It will even classify bugs as liveness or correctness for you. It's like your own Jepsen, except you can inject storage faults, speed up time, and replay anything you find from a seed. Again, the only reason we were explicit about scope really, is because of our own experience doing bounty programs that were underspecified. For example, while it should be clear enough that this is a distributed systems and consensus bug bounty challenge, literally called “Viewstamped Replication Made Famous”, we didn't want anyone to be confused and think it was a security bug bounty. That's the only reason it's excluded, because we want people to break our consensus. Nevertheless, we do have small awards for interesting findings. So I hope you'll give it a shot! We'd love to announce and award your findings. For example, why not take on the challenge during HYTRADBOI's database jam? https://www.hytradboi.com/jam https://www.hytradboi.com/jam
tialaramex 4y ago
This involves a serious, perhaps even fatal, misunderstanding. It was not impossible to write safe C. That's sort of ironically illustrated by WUFFS. WUFFS-the-library is literally C source code. C source code for a safe, very high performance data processing library. A human could have written that library in C. But they didn't, humans wrote that software in WUFFS-the-language and the tool which turned that into C to produce WUFFS-the-library. So, this bounty can't do what you claim. The existence of TigerBeetle, apparently high quality software written in Zig, doesn't mean somehow Zig is how you produce high quality software, any more than the fact somebody beat a Dark Souls game with a guitar controller means the guitar controller makes Dark Souls easier to beat.
- avgcorrection 4y ago
  And the highest-level, most safe language can be compiled to machine code... you are not proving anything at all. Everyone already understands how compilers work. So they don’t care that Brainfuck can in principle (although not in practice) be written perfectly by people.

avgcorrection 4y ago

Who or what hyper-focuses on memory safety? (And settles for it?) Pray tell, what could the Zig VP of community be alluding to out of the blue without any prompt whatsoever?

kristoff_it 4y ago
Just read any other HN Zig thread and you will find an easy answer to your question :^)