2 ms·

Humans did do it before. ------------------------ It's also worth pointing out that the developers at Mozilla literally decided to make a brand new programmin

Humans did do it before. ------------------------ It's also worth pointing out that the developers at Mozilla literally decided to make a brand new programming language (Rust) that eliminated an entire categories of bugs and started working on a new browser (Servo) where its components could be switched into firefox. Then Mozilla fired the team working on it. Lesson 1: Better tools and processes eliminate bugs. Lesson 2: If you don't have the tools, make them. Lesson 3: Mismanagement leads to security vulnerabilities.

Ar-Curunir 12d ago
Yes, and even after introducing and using Rust, there were still vulns in the remaining code. FWIW, Rust is my main language, so I am grateful to the humans that created it, and it is indeed a monumental effort. But vuln finding is a different kind of creative endeavour, and one that is heavily weighted against defenders.
- spartanatreyu 12d ago
  Yes, which is why you don't stop at rust. You would choose rust (from a security standpoint) because it massively reduces memory safety issues (which from a Microsoft study was responsible for around 70% of bugs). Then you look at things like linting, fuzzing, design by contract, proofing, deterministic test runs, etc... As I said above: use better tools and processes. LLMs don't fit that criteria.
eviks 12d ago
Good point about the whole new language as a tool for eliminating many thousands(?) as a whole category
Someone 11d ago
> It's also worth pointing out that the developers at Mozilla literally decided to make a brand new programming language (Rust) In my memory, that does not seem 100% right. And indeed https://en.wikipedia.org/wiki/Rust_(programming_language)#2006–2009:_Early_years https://en.wikipedia.org/wiki/Rust_(programming_language)#20... says a single developer who happened to work at Mozilla started it as a personal project. After a few years Mozilla became interested in it and then sponsored its development, transforming it into the language it is today.

Ar-Curunir 12d ago

Yes, and even after introducing and using Rust, there were still vulns in the remaining code. FWIW, Rust is my main language, so I am grateful to the humans that created it, and it is indeed a monumental effort. But vuln finding is a different kind of creative endeavour, and one that is heavily weighted against defenders.

spartanatreyu 12d ago
Yes, which is why you don't stop at rust. You would choose rust (from a security standpoint) because it massively reduces memory safety issues (which from a Microsoft study was responsible for around 70% of bugs). Then you look at things like linting, fuzzing, design by contract, proofing, deterministic test runs, etc... As I said above: use better tools and processes. LLMs don't fit that criteria.

eviks 12d ago

Good point about the whole new language as a tool for eliminating many thousands(?) as a whole category

Someone 11d ago

> It's also worth pointing out that the developers at Mozilla literally decided to make a brand new programming language (Rust) In my memory, that does not seem 100% right. And indeed https://en.wikipedia.org/wiki/Rust_(programming_language)#2006–2009:_Early_years https://en.wikipedia.org/wiki/Rust_(programming_language)#20... says a single developer who happened to work at Mozilla started it as a personal project. After a few years Mozilla became interested in it and then sponsored its development, transforming it into the language it is today.