4 ms·

Outside of regulated fields like healthcare and travel is the market even significant for such tooling? Can't say I know any shop that prioritizes code correctn

Outside of regulated fields like healthcare and travel is the market even significant for such tooling? Can't say I know any shop that prioritizes code correctness outside of press releases.

GuB-42 4y ago
You can add energy and defense to the list. And regulated fields are a big market, not just the huge companies that work in this field (you can see a short list on the linked page), but also suppliers of these companies.
defrost 4y ago
Geophysical data aquisition, processing, interpretation. Fire simulation modelling. Computational GIS tooling (Hexagon et al) Computational Algebra (eg Cayley|Magma) Fireball monitoring, Square Kilometre Array processing, . . . I'm struggling to recall anything I've worked on that didn't emphasis code correctness.
jamesfinlayson 4y ago
If there's a high enough risk, maybe. I've worked in gambling (regulated, but not to the same degree as something that's life and death) and the security team has pushed for the use of tools like this.
ryao 4y ago
I am interested in using it on OpenZFS. I will probably try the trial in a couple months. Assuming that it does well, it is unfortunate that I will not be able to use it beyond the trial period, since I expect the price to be too expensive.
- nextos 4y ago
  That's my point, IMHO this is much more useful than LLM-autocompletion right now. But there are so few options available, at such a high cost, that nobody uses them. Abstract interpretation / static analysis can detect lots of defects automatically.
  - transpute 4y ago
    Attackers can use trial versions to narrow their search for 0-day defects.
    - edwcross 4y ago
      In practice, it's not that easy; fuzzers tend to be more effective for that. Usually, the time required to properly setup and understand and refine the analysis will take most of the trial period. These tools are better thought of in the long term, they may require some changes to coding style, and also some knowledge of the code itself. While they are good for building defenses, they are not so effective for helping attackers. But in the end, yes, they _could_ be used for that.
eddsh1994 4y ago
Networking? Defense? Operating systems? Etc
- ryao 4y ago
  Most operating system developers are unlikely to be able to afford it given how it’s pricing is “if you need to ask, it costs too much”. :/

Outside of regulated fields like healthcare and travel is the market even significant for such tooling? Can't say I know any shop that prioritizes code correctness outside of press releases.

GuB-42 4y ago

You can add energy and defense to the list. And regulated fields are a big market, not just the huge companies that work in this field (you can see a short list on the linked page), but also suppliers of these companies.

defrost 4y ago

Geophysical data aquisition, processing, interpretation. Fire simulation modelling. Computational GIS tooling (Hexagon et al) Computational Algebra (eg Cayley|Magma) Fireball monitoring, Square Kilometre Array processing, . . . I'm struggling to recall anything I've worked on that didn't emphasis code correctness.

jamesfinlayson 4y ago

If there's a high enough risk, maybe. I've worked in gambling (regulated, but not to the same degree as something that's life and death) and the security team has pushed for the use of tools like this.

ryao 4y ago

I am interested in using it on OpenZFS. I will probably try the trial in a couple months. Assuming that it does well, it is unfortunate that I will not be able to use it beyond the trial period, since I expect the price to be too expensive.

nextos 4y ago
That's my point, IMHO this is much more useful than LLM-autocompletion right now. But there are so few options available, at such a high cost, that nobody uses them. Abstract interpretation / static analysis can detect lots of defects automatically.
- transpute 4y ago
  Attackers can use trial versions to narrow their search for 0-day defects.
  - edwcross 4y ago
    In practice, it's not that easy; fuzzers tend to be more effective for that. Usually, the time required to properly setup and understand and refine the analysis will take most of the trial period. These tools are better thought of in the long term, they may require some changes to coding style, and also some knowledge of the code itself. While they are good for building defenses, they are not so effective for helping attackers. But in the end, yes, they _could_ be used for that.

eddsh1994 4y ago

Networking? Defense? Operating systems? Etc

ryao 4y ago
Most operating system developers are unlikely to be able to afford it given how it’s pricing is “if you need to ask, it costs too much”. :/