Post

conputer dipshit
@davidcrespo.bsky.social

would be interested to see more debate on this from security types and even some formal modeling. my hunch is that you can lock down individual systems quite well and the ways they interact in such a way that the probability of end to end exploits goes tolerably close to zero x.com/CJHandmer/st...

Andrew Lilley Brinker
@alilleybrinker.com

Worth distinguishing vulnerabilities in individual pieces of software from vulnerabilities in systems. Software security *can* drive vulns to ~0, IMO. System security is harder! Tons of things, like ”does X person need Y access,” are properties of the real world.

Techy Ben
@techyben.bsky.social

I'd argue the opposite. Can never verify a single program doesn't have a vuln we missed. But can confirm is the network itself is hardened or not.

Andrew Lilley Brinker
@alilleybrinker.com

1. Formal methods exist and are becoming much easier / cheaper with AI. We can prove strong properties up to the limit of the formal system. 2. Vulnerabilities decay exponentially (see link), and we can get asymptotically assured about the security of individual software.

security.googleblog.comEliminating Memory Safety Vulnerabilities at the SourcePosted by Jeff Vander Stoep - Android team, and Alex Rebert - Security Foundations Memory safety vulnerabilities remain a pervasive threa...

0 reposts7 likes

No replies yet.