Slashdot Mirror

← Back to Stories (view on slashdot.org)

Fixing Bugs, But Bypassing the Source Code

Posted by timothy on from the wrapping-puzzles-in-enigmas dept.

shreshtha contributes this snippet from MIT's Technology Review: "Martin Rinard, a professor of computer science at MIT, is unabashed about the ultimate goal of his group's research: 'delivering an immortal, invulnerable program.' In work presented this month at the ACM Symposium on Operating Systems Principles in Big Sky, MT, his group has developed software that can find and fix certain types of software bugs within a matter of minutes." Interestingly, this software doesn't need access to the source code of the target program.

18 of 234 comments (clear)

  1. I sure wouldn't by Korbeau · · Score: 5, Funny

    run this software before running ClearView on it first. Imagine what this could do if it had a bug in its code!

  2. This really deserves by fuzzyfuzzyfungus · · Score: 4, Funny

    A "whatcouldpossiblygowrong". Along with, just to be on the safe side, a "colossustheforbinproject", a "shodan", a "hal", a "skynet" and probably a bunch of others that I'm forgetting right now.

  3. ...an immortal, invulnerable program... by John+Hasler · · Score: 4, Funny

    Has anyone cracked "Hello World" yet?

    --
    Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
  4. Re:It's interesting, but software should "expire". by Anonymous Coward · · Score: 4, Funny

    This doesn't support innovation and improvement, and that's the cornerstone of technology improvement.

    Please allow myself to introduce... myself.

  5. Re:MS will probably kill it by SnarfQuest · · Score: 5, Insightful

    If MS included this in Windows, you'd never get to see the login screen because the CPU would be so busy fixing bugs.

    --
    Who would win this election: Andrew Weiner vs Andrew Weiner's weiner.
  6. If humans did the same..! by Odinlake · · Score: 4, Funny

    The very first time ClearView encounters an exploit it closes the program and begins analyzing the binary, searching for a patch that could have stopped the error.

    Think of how much bullshit would go out of business if people were to do the same thing (i.e. sit down and think it over) when presented with some unusual idea.

  7. Did they use that tool to develop that tool? by 140Mandak262Jamuna · · Score: 5, Interesting
    My friend developed an automatic code quality estimation program for his masters thesis. It will basically find average the number of lines per function, ratio of code to comment, and other such metrics and give a letter grade to the code. The fiendish prof announced that he will run that code through itself. Whatever letter grade it spits out will be his thesis grade. He got a D. He begged and cried and threw a hissy fit and wangled a B and scraped through the degree.

    I wonder if we should turn that software loose on itself and see what it finds.

    --
    sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
    1. Re:Did they use that tool to develop that tool? by Wonko+the+Sane · · Score: 5, Insightful

      The fiendish prof announced that he will run that code through itself. Whatever letter grade it spits out will be his thesis grade. He got a D. He begged and cried and threw a hissy fit and wangled a B and scraped through the degree.

      Fiendish? What could possibly be more fair and objective than making him eat his own dogfood?

    2. Re:Did they use that tool to develop that tool? by KillerBob · · Score: 4, Insightful

      Either that or put in an author check that automatically spits out an A+ if it detects that the author of the code was himself....

      --
      If you believe everything you read, you'd better not read. - Japanese proverb
  8. Re:clearview by Anonymous Coward · · Score: 5, Funny

    So run two.

  9. Sensationalism ruined it for me by billcopc · · Score: 4, Insightful

    When a potentially harmful vulnerability is discovered in a piece of software, it takes nearly a month on average for human engineers to come up with a fix and to push the fix out to affected systems

    Yes. It takes us 5 seconds to an hour to actually come up with the fix, the remainder of the month is spent in bureaucratic hell - sitting in a trouble ticket queue, sitting in a verification queue, sitting in a QA manager's inbox, sitting with the communications team.

    Clearview, if it does what it says on the tin, only addresses the 5 second problem. Any "sane" dev shop would still run the resultant patch through the many cogs and loops of modern software management. You won't get your hole patched any quicker, you'll just have shifted the coders' attention away from your own app's bugs, and onto Clearview's bugs. Net gain: less than zero.

    Theoretically and conceptually, it's an interesting tool (you know, like Intercal). It just doesn't really fit in the industry, IMHO.

    --
    -Billco, Fnarg.com
  10. How about by raddan · · Score: 4, Insightful

    "Entscheidungsproblem". You'd think a professor of CS at MIT would have heard of it.

    1. Re:How about by raddan · · Score: 4, Interesting

      You can't write an algorithm that takes as input another algorithm and outputs whether that second algorithm is correct or not. Since ClearView must make this decision somehow (this behavior is bad; make it good), the process cannot be algorithmic. However-- this is exactly how the vast majority of software is written now-- a programmer has a good idea about how to solve the problem, but does not "provably" solve it. If you believe language designers, that's part of the problem. ClearView just adds another layer of heuristics on top of the ones that are already there. Someone has to come up with those rules. This makes the actual work of understanding a program much more complicated. But, you know, the MIT people have been chasing AI for a long time, so maybe they don't think that understanding something is important as long as there's a good simulacrum of the thing they're trying to create. Black box computer science.

    2. Re:How about by eggnoglatte · · Score: 4, Insightful

      Except that you are making two mistakes:

      - the Entscheidungsproblem refers to the problem of finding a general solution that will determine for all possible programs whether or not they are correct. This is an undecidable problem. However, this does NOT mean you can't find a solution for certain subclasses of programs, or a program that finds certain kinds of flaws.

      - also, you already know there is an error (otherwise the program wouldn't be triggered), and the type of error (e.g. NULL pointer, array index out of bounds etc.) . That makes much easier again than the general Entscheidungsproblem.

    3. Re:How about by TheLink · · Score: 4, Interesting

      Clearview doesn't have to figure out whether the entire program is correct. It just tries to fix what's known to be incorrect (and presumably whether it falls into the subset of bugs it knows how to fix).

      The sort of "correctness" and "incorrectness" for many security problems are typically "stupid mistakes" nothing very sophisticated.

      You're taking too much of the "Ivory Tower Computer Science" view on this. Car analogy - Clearview isn't figuring out whether the whole car is perfect (in the real world it's 100% likely to be imperfect anyway ;) ), all it does is help detect and fix the holes in the exterior. It doesn't have to perfectly fix stuff.

      FWIW I've already manually fixed programs without having the source, and managed to get a program to do stuff the manufacturer said the program can't do ;). I've also fixed a TCL program stored in an oracle database by hexediting the oracle DB file, but since that was TCL it doesn't count as "without the source"...

      Just because you can't make it perfect doesn't mean you can't make it work better.

      --
  11. sensasionalists ? by cameigons · · Score: 4, Informative

    I'm sick of the stupid headlines I've been reading about the so called projects of MIT students lately... I mean, clearly an 'immortal invulnerable program' is impossible at least for practical purposes by definition(they're dependent on the underlying OS, on other softwares and last but not least on the hardware integrity). Other recent headlines about their CS students claiming to be able to tell who's gay based on their facebook friends.... pff omg, when did it all get so preposterous. Why aren't they more honest about the reach of their ambitions. If you take these teachers words to the letter it seems like they don't know what's theoretically sound and what isn't...

  12. Re:MS will probably kill it by Xtifr · · Score: 4, Informative

    imagine the sheer volume of .CONF files a Linux user would have to waft through just to get this to check a distro for bugs.

    501:~ $ locate .CONF
    502:~ $

    Looks like the volume is...zero? I think maybe I don't understand what you mean. Is ".CONF" some sort of Windows-speak for configuration files? If so, then the fact that they're all in /etc (or possibly /usr/etc or /usr/local/etc) and /home should make them very easy to skip.

  13. Re:MS will probably kill it by mewsenews · · Score: 5, Funny

    If MS included this in Windows, you'd never get to see the login screen because the CPU would be so busy fixing bugs.

    Geez... imagine the sheer volume of .CONF files a Linux user would have to waft through just to get this to check a distro for bugs.

    Is this some sort of "out-stereotype the operating system" competition? If so, here is my entry:

    If the tool from TFA existed already, Mac users wouldn't notice it until Steve Jobs named it the iPatcher and made some cutesy advertisements with Justin Long wearing an eye patch. At that point they'd proclaim it made their systems invulnerable to bugs in a far superior way than Windows and Linux.