Slashdot Mirror
Fixing Bugs, But Bypassing the Source Code
shreshtha contributes this snippet from MIT's Technology Review: "Martin Rinard, a professor of computer science at MIT, is unabashed about the ultimate goal of his group's research: 'delivering an immortal, invulnerable program.' In work presented this month at the ACM Symposium on Operating Systems Principles in Big Sky, MT, his group has developed software that can find and fix certain types of software bugs within a matter of minutes." Interestingly, this software doesn't need access to the source code of the target program.
If MS included this in Windows, you'd never get to see the login screen because the CPU would be so busy fixing bugs.
Who would win this election: Andrew Weiner vs Andrew Weiner's weiner.
If the programs that Clearview is monitering/patching are the target, wouldn't it make sense for an attacker to focus on Clearview first? Perhaps even alter its function to serve the purposes of the attacker instead of the user. Why attack the programs it is patching when you could hit Clearview and gain the ability to hijack everything it is patching?
Sigs are too short to say anything truly profound so read the above post instead.
If MS included this in Windows, you'd never get to see the login screen because the CPU would be so busy fixing bugs.
Geez... imagine the sheer volume of .CONF files a Linux user would have to waft through just to get this to check a distro for bugs.
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
There has been no silver bullet in Software Engineering, not for attacker and not for defenders. I highly doubt this is one. From the article, I gather that this is actually some kind of macro Design by Contract based self-fixer. This means it is at best just as good as the people writing the contracts. It will however fail for more complex contracts, which are needed frequently in practice, unless it can get over all sorts of theoretical and practical limitations. And it will make behavior non-predictable, since your software could be patched at any time.
I would say this is a pretty bad idea, both from a security point of view and from a data-integrity and software reliability point of view.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
When a potentially harmful vulnerability is discovered in a piece of software, it takes nearly a month on average for human engineers to come up with a fix and to push the fix out to affected systems
Yes. It takes us 5 seconds to an hour to actually come up with the fix, the remainder of the month is spent in bureaucratic hell - sitting in a trouble ticket queue, sitting in a verification queue, sitting in a QA manager's inbox, sitting with the communications team.
Clearview, if it does what it says on the tin, only addresses the 5 second problem. Any "sane" dev shop would still run the resultant patch through the many cogs and loops of modern software management. You won't get your hole patched any quicker, you'll just have shifted the coders' attention away from your own app's bugs, and onto Clearview's bugs. Net gain: less than zero.
Theoretically and conceptually, it's an interesting tool (you know, like Intercal). It just doesn't really fit in the industry, IMHO.
-Billco, Fnarg.com
"Entscheidungsproblem". You'd think a professor of CS at MIT would have heard of it.
Fiendish? What could possibly be more fair and objective than making him eat his own dogfood?
"Fiendish" prof? If this is even a true story, it rates a "duhh!" Of course he should have ran his analyzer on his own code..
Either that or put in an author check that automatically spits out an A+ if it detects that the author of the code was himself....
If you believe everything you read, you'd better not read. - Japanese proverb
Me-thinks someone sounds jealous they did not think of it first.
How amazed would you be to suddenly find that you just forgot what I wrote and you needed to reread my post.... again.
Hmmm. Sounds like some CS urban legend. Never heard - not once - of a "thesis grade". Pass, no-pass, conditional pass. I didn't receive a grade myself. Just a diploma. Be great for those kind of folks that put GPA's on their CV, though.
46 & 2
But was it a source patch, or a binary patch? A binary patch is at best a dirty work-around, becuase the bug will keep reappearing in subsequent released of the software (perhaps even in needed patches for other issues).
Socialism: a lie told by totalitarians and believed by fools.
It will basically find average the number of lines per function, ratio of code to comment, and other such metrics and give a letter grade to the code.
int is_equal(int a, int b) {
if ((a = b)) {
return 1;
}
return 0;
}
Do I get an A?
... also, I can kill you with my brain.
Being graded on the quality of the ideas in the thesis and not the implementation?
Why even implement then? Just write a paper and be done with it.
In other words, if the MSc thesis requirements include an implementation then clearly the quality of the implementation is going to be evaluated.
If that guy ever gets a real job outside of academia the lesson he learned from that singular experience will probably define his career.
When information is power, privacy is freedom.
paff. People have been doing this with SuperZap on mainframe code for 30 years. Kids.
Now get off my lawn.
I was taught to respect my elders. The trouble is, it's getting harder and harder to find some.
That would obviously bring SkyNet into existence!