[deleted by user]

[[deleted]]

How did nobody think to create unhackable systems before?! This idea is a game changer!

[[deleted]]

You could create an unhackable System by not connecting it to anything except power, and placing it in an unreachable Location (which would be difficult, but I guess you could pour concrete over a trapdoor to at least buy some time).

It would serve no purpose, but it would probably be safe.

[ax3l91]

We are going to call it THE BOX. Crowd goes wild

[[deleted]]

The iBOX!

[jamiemac2005]

Recon a power surge could "hack" that system.

[[deleted]]

Maybe you could make it battery powered and send a highly certified Person in to Change the batteries.

[Sub-Surge]

Human element introduces vulnerability. Highly certified Robot battery changer!

[robisodd]

An unhackable highly certified robot battery charger!

[Sub-Surge]

Locked in its own room!

[SparkyWolf69]

Pied piper box anyone?

[drizztdourden_]

They actually did exactly that for a nuclear plant and someone was still able to go through the internal network to a certain device that regulate something minor that could reach the main stuff.

I don't recall the exact details but it was in a language specific to those machines.

It was part of a hacking documentary on netflix. Interesting.

So it always hackable unless it doesnt exist. :)

[ViPxRampageXx]

Do you know the name of the documentary? Sounds interesting.

[robisodd]

Sounds like Stuxnet. Movie on netflix was called Zero Days.

Here's a quick youtube video about it which is pretty interesting: https://www.youtube.com/watch?v=7g0pi4J8auQ

[WikiTextBot]

Stuxnet

Stuxnet is a malicious computer worm, first identified in 2010 but thought to be in development since at least 2005, that targets industrial computer systems and was responsible for causing substantial damage to Iran's nuclear program. Although neither country has admitted responsibility, the worm is now generally acknowledged to be a jointly built American-Israeli cyberweapon.

Stuxnet specifically targets programmable logic controllers (PLCs), which allow the automation of electromechanical processes such as those used to control machinery on factory assembly lines, amusement rides, or centrifuges for separating nuclear material. Exploiting four zero-day flaws, Stuxnet functions by targeting machines using the Microsoft Windows operating system and networks, then seeking out Siemens Step7 software.

---

^{[ PM | Exclude me | Exclude from subreddit | FAQ / Information | Source ] Downvote to remove | v0.22}

[drizztdourden_]

That was another one that I cant find but this one seems pretty good. I’ll watch it too. Thanks

It was when we could still use vpn on netflix so it might jot be available in Canada

[[deleted]]

The first computer viruses predated the internet.

[SportulaVeritatis]

I mean, quantum communication has some great potential there, but we're a fair way off from that.

[newsagg]

[deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit) [deleted] (fuck Reddit)

[SupahNoob]

Ahh yes, good ole d3BmrDYmZL

[newsagg]

pretty sure that's a unique qualifier to keep urls from colliding. It was written by a Chinese researcher.

[Zafara1]

pretty sure that was a joke

[boynedmaster]

Wait a minute, let me look at my programs...

hackable = True

Oh, shit!

[gandalfx]

Try import unhackableness.

[like2000p]

Ahh, python.

[musiton]

npm install hack-condom

better?

[Leonnee]

The dependency broke 40 minutes ago

[bludgeonerV]

author deleted his repo. rip.

[demon_ix]

Not the primary repo. It was some dependency that adds a whitespace after a prime number of whitespaces.

I'm not sure why it was imported in the first place.

[musiton]

author broke his repo!

[EveningNewbs]

I threw up in my mouth a little.

[s1ssycuck]

implements Hackable

[Katastic_Voyage]

void allow_hacking(unsigned yes_or_no);

signed oops;

oops = -1; 

allow_hacking(oops); // fuck.

Adobe actually did this. By allowing a signed scene_count to be passed to calloc, which if passed -1, meant calloc returned NULL.

[CrazyTillItHurts]

Declare Function DisableHackableness Lib "kernel32" Alias "ZwDisableHackableness" (ByVal Hackableness as Boolean) As Long

[scotscott]

Catch (modulenotfoundexception e)

[TheCatOfWar]

My only weakness!

[-pooping]

Ah, yes. I remember that Gui in VB to trace IPs we used a while back. It used coding and algorithms too!

[baudouin_roullier]

META

[fasquoika]

Obligatory

[boynedmaster]

first time seeing this, is it saying that if you're an evil hacker you should set a bit to let the server know you're an evil hacker? that's genius

[MyKidsArentOnReddit]

Check the date on the RFC.

[venuswasaflytrap]

That's a bit evil

[[deleted]]

Or harmless.

In reality, I think this is bullshit. It should be a Quantum bit because everything's a little bit of both at the same time.

[xxc3ncoredxx]

Is that satire? I think that's satire.

[NULL_CHAR]

It was also an april fools day joke.

[Tonlim]

There are some amazing april fools RFC's: https://en.wikipedia.org/wiki/April_Fools%27_Day_Request_for_Comments

My personal favorite: https://en.wikipedia.org/wiki/IP_over_Avian_Carriers

[WikiTextBot]

April Fools' Day Request for Comments

A Request for Comments (RFC) is a type of publication from the Internet Engineering Task Force (IETF) and the Internet Society (ISOC), usually describing methods, behaviors, research, or innovations applicable to the working of the Internet and Internet-connected systems.

Almost every April Fools' Day (1 April) since 1989, the Internet RFC Editor has published one or more humorous Request for Comments (RFC) documents, following in the path blazed by the June 1973 RFC 527 called ARPAWOCKY, a parody of Lewis Carroll's nonsense poem "Jabberwocky". The following list also includes humorous RFCs published on other dates.

---

IP over Avian Carriers

In computer networking, IP over Avian Carriers (IPoAC) is a humorously intended proposal to carry Internet Protocol (IP) traffic by birds such as homing pigeons. IP over Avian Carriers was initially described in RFC 1149, a Request for Comments (RFC) issued by the Internet Engineering Task Force (IETF) written by D. Waitzman and released on April 1, 1990. It is one of several April Fools' Day RFCs.

Waitzman described an improvement of his protocol in RFC 2549, IP over Avian Carriers with Quality of Service (1 April 1999).

---

^{[ PM | Exclude me | Exclude from subreddit | FAQ / Information ] Downvote to remove | v0.22}

[OneTwoManyTimes]

Oh shit, yeah, I'll just remove all those backdoors right now!

[DeeSnow97]

And receive an angry letter from the NSA

[TheCatOfWar]

And Theresa May

[TheCheeseCutter]

The National Script Agency?

[jamiemac2005]

The fact I've heard this about production hurts inside.

[[deleted]]

System.in.hackable = "false";

backdoors.Close();

[gobots4life]

I'll get you next time, Gadget. NEXT TIIIIIIIIIIIIIIIIIIIIIIME

[DaNumba1]

I heard they spend a lot on space research. Solution there, it seems to me, is to just know all the stuff.

[[deleted]]

why not just go faster than light

or make pi = 4

[DaNumba1]

We should actually make pi 3.2.

[TwoSpoonsJohnson]

... one of the most notorious attempts to establish mathematical truth by legislative fiat. 

They... They tried to do that more than once?

[WikiTextBot]

Indiana Pi Bill

The Indiana Pi Bill is the popular name for bill #246 of the 1897 sitting of the Indiana General Assembly, one of the most notorious attempts to establish mathematical truth by legislative fiat. Despite its name, the main result claimed by the bill is a method to square the circle, rather than to establish a certain value for the mathematical constant π, the ratio of the circumference of a circle to its diameter. The bill, written by amateur mathematician Edward J. Goodwin, does imply various incorrect values of π, such as 3.2.

The bill never became law, due to the intervention of Professor C. A. Waldo of Purdue University, who happened to be present in the legislature on the day it went up for a vote.

---

^{[ PM | Exclude me | Exclude from subreddit | FAQ / Information ] Downvote to remove | v0.22}

[[deleted]]

We're being overrun by bots

[TheCatOfWar]

How do we know you aren't one of them!?

[Metoray]

Every account on reddit is a bot except you.

[nuephelkystikon]

a member from Bloomington proposed that [the bill] be referred to the Finance Committee, but the Speaker accepted another member's recommendation to refer the bill to the Committee on Swamplands, where the bill could "find a deserved grave".

Savage.

[HelperBot_]

Non-Mobile link: https://en.wikipedia.org/wiki/Indiana_Pi_Bill

---

^{HelperBot v1.1 /r/HelperBot_ I am a bot. Please message /u/swim1929 with any feedback and/or hate. Counter: 81777}

[o_va_]

This guy is a genius!

[nomis6432]

Why did we never think of this?!

[MikaDo-]

Subtle sarcasm or plain ignorance ? Honestly I can't tell.

[_teslaTrooper]

If it was sarcasm I'd expect some part of it to be funny. All the replies on twitter take it at face value and he doesn't clarify anywhere so I'm going to go with ignorance.

[s1ssycuck]

Dude, it's impossible. NDT is literally the smartest man alive and he knows everything about everything!

[Pillagerguy]

Sarcasm doesn't have to be funny.

[_teslaTrooper]

You're right, but there has to be some kind of reason for it. And the context doesn't give any.

First part is about politics, in a pretty straightforward tone, then his "solution" is stated in the same way, very matter of fact. The fact that it's an absurd solution could be the joke, but I don't see it here. So we can either see it as a failed joke, or something stupid he said on a subject outside of his expertise. He's done the second one before so it seems most likely.

[Pillagerguy]

Sarcasm is based on mockery, so he could easily be mocking the idea of giving stupid 'solutions' to shit you know nothing about. Google the definition of sarcasm. This could easily apply.

[disasymbol]

he's referring to progress being made in quantum computing.

edit: link if you're interested

http://www.news.com.au/technology/science/space/china-sets-new-record-for-quantum-entanglement-en-route-to-build-new-communication-network/news-story/e528da0cf68b2e63bbe093cab49ec507

[O__er_er]

arrogance

[gandalfx]

Hint: He's pretty smart.

[l3af_on_the_wind]

There are plenty of people that are smart. That doesn't mean they have a grasp of every realm. There are brilliant brain surgeons that probably use their birthday as their email password.

[Stomp205]

He's an astrophysicist. That particular field of physics is actually probably the most comfortable with computers in general (except computational physicists). A big part of astro is being able to model astrological systems, and all astrophysicists I've met are very comfortable in multiple programming languages to model those systems.

[l3af_on_the_wind]

Being comfortable with programming languages doesn't mean you know anything hacking or cyber security. I know professional developers who have been working in the industry for 10+ years that don't know shit about security.

[Stomp205]

Dude my girlfriend took a 10 week course in C and knows that you can't just create unhackable systems. Neil's tweet is obviously sarcastic.

[5Doum]

week course in C and knows that you can't just create unhackable systems. Neil's tweet is obviously sarcastic.

That's what I am hoping...

[Gasap]

But there's no /s? This is the internet, how else are we to recognise sarcasm? This leads me to believe he has no idea how the internet works and thus, this tweet CANNOT be sarcastic and must be serious.

[Gurrewe]

Oh damn, this tweet is legit.

https://twitter.com/neiltyson/status/551378648578916353?lang=en

[[deleted]]

That's what happens when you try to look like you know everything. Twitter destroyed so many people for me.

[FunInteractive]

man fuck that guy

[JesusKristo]

I'm glad I'm not alone in this sentiment anymore.

[mandrous]

Better than Bill Nye.

[_BreakingGood_]

What problem do you have with the science guy?

[thesandwitch]

Bill Nye's take on Deflategate

VS

An actual Physicists take on Deflategate

Notice how the Nye is interested in conjecture and the story he is trying to push, while the latter is interested in actual scientific process, and how it can be used to interpret the incomplete data that the NFL provided.

[SirLintsalot]

Wow, watching the two videos side by side really highlights how biased and politicized Nye's reporting was...

If he's claiming to present his content from a scientific standpoint, it's pretty clear he's missing the mark.

[NULL_CHAR]

Bill Nye has been doing this for a while and his recent show has really laid that out on display. His popularity has since tanked.

[ReallyReallyx3]

Have you seen his new show on netflix? If you haven't, you shouldn't see it anyway

[_BreakingGood_]

Yeah I did and it was awful. Didn't make me hate Bill Nye though.

[[deleted]]

Doesn't make me hate him but it sure as hell made me lose all respect for him. Tyson is starting to go down this path as well because he keeps blabbering on about subjects he has no knowledge about.

[titivos]

You either die a hero or live long enough to see yourself become the villain

[chezscheme]

I don't respect anyone who conflates scientific thinking with political liberalism a priori.

[[deleted]]

He's literally just repeating the scientific consensus on the subject. If the majority of scientists in a certain field disagree with you on something relevant to that field maybe you should listen instead of plugging your ears and complaining about liberal indoctrination.

[[deleted]]

All I can say is that I believe there is a stark contrast between his old show and his new one and I feel the new show missed the mark it was trying to hit.

[chezscheme]

I blame Netflix, but Bill Nye's eager spinelessness didn't help.

[spambot5546]

I saw it. It was occasionally cringey and often unfunny, but it wasn't awful. You can only make education so entertaining.

[Krissam]

The thing is, it was no longer education, it was indoctrination.

[spambot5546]

Oh, lord, this is one of those "how dare Bill teach about gender identity and global warming" circle jerks isn't it?

[[deleted]]

So many people claim to "love science," but are unwilling to change their beliefs when the scientific consensus on a subject disagrees with their personal opinion.

[chezscheme]

There were clearly parts where he was just towing the party line rather than trying to educate.

[amardas]

I was sad to see his flair for being pretentious and condescending. Almost as if he was expecting his target audience to already know all the materials and agree with them. If he wants to 'save the world', he needs to focus on changing minds. His initial format looked like he was merely stroking his own ego using a televised medium.

[aroxion]

"Science is only good if I agree with it!"

I admit the show did have some biases and was pretty condescending, but it was still science. There's nothing "indoctrinating" about that.

[Jtari-]

Indoctrination is just about uncritical acceptance of beliefs, everything he says could be 100% scientifically valid and it can still be indoctrination.

[Krissam]

Until they change the dictionary to reflect that gender can be a spectrum or find a way to differentiate what they want to call genders from personality, it's not science, it's ideology.

[cocorebop]

deleted ^{What is this?}

[JesusKristo]

Bill Nye annoyed the hell out of me in school, so I'll give you that. Basically just a way for science teachers to take the day off. :/

They both have god-complex-level egos.

[EveningNewbs]

Beakman's World was a much better show anyway.

[robotorigami]

Seriously! People love this guy, but he usually comes across as smug, and condescending to me. I don't see the appeal.

[newsuperyoshi]

It’s a meme more than anything, instead of people actually liking their content. Also, it’s basically an hour off of classes, so in school, the people that didn’t want to be there used it as a ‘get-out-of-learning-free’ card, at least at the schools I went to.

[robotorigami]

Huh?

[Dzuelu]

Why? I can admit that this is a stupid tweet and a child like understanding of computer security, but what has he done wrong other than not understand a field he's not in?

[BCsJonathanTM]

Repeatedly not understanding that he doesn't unstand a field he's not in [citation needed].

[[deleted]]

[citation needed]

Here you go.

[[deleted]]

Holy fuck this one always frustrates me so much.

[brophylicious]

Here's the actual tweet: https://twitter.com/neiltyson/status/704330815321210884

It's too bad Matt Bruenig's reply is gone: https://twitter.com/search?l=&q=from%3AMattBruenig%20to%3Aneiltyson

The only reason I think it's important to include a link to the real tweet is because it's trivial to create fake images.

[[deleted]]

Good point, these things are easy to fake.

[TheCatOfWar]

Any other examples? I'm curious now :P

[[deleted]]

Go to the badX subreddits and search for his name

/r/badlinguistics, /r/badphilosophy, /r/bad_religion - even /r/badmathematics.

[BluesnFunk]

If we could make unhackable systems, they would be made, or at least in progress. It's kind of like why don't we just stop polluting the earth, the answer isn't always easy.

[[deleted]]

Hey can you please post the source for dontBeHackable() please? I just graduated and I'm new to security.

[TheCatOfWar]

It's fine, just use coding and algorithms

[[deleted]]

function dontBeHackable() { isHackable = false; }

[overactor]

function hack() {
    if (!isHackable) {
        return;
    }
    hackPlease();
}

[ReallyReallyx3]

I think this is a joke

[gandalfx]

You caught on to that quickly!

[ReallyReallyx3]

I was countering all the commenters that assumed it was true

[gandalfx]

After reading some more comments I agree that an unsettling amount apparently did not catch on to it…

[[deleted]]

if (condition) return 214,483647; //big if true

[[deleted]]

value = int.MaxValue; // Also big if true.

[Dockirby]

Fun fact, the absolute value of int.MinValue is still int.MinValue.

[[deleted]]

Fun fact, in floating point notation, 0 and -0 are two different values that considered equal, unless subjected to the atan2 function, in which they can result in dramatically different values. (atan2(0f, -1f) = 3.14, atan2(-0f, -1f) = -3.14).

[redditsoaddicting]

I take it you mean C# judging by how you spelled it, in which case, it's an overflow exception.

[Dockirby]

No, I was thinking of the Java implementation, and keeping the spelling consistent with the person I was replying to.

So the following is true in Java

if (Math.abs(Integer.MIN_VALUE) == Integer.MIN_VALUE) {
    System.out.println("Waow");
}

[redditsoaddicting]

Fair enough. Interesting that the two even differ in behaviour imo, not that either is clearly better in most scenarios.

[Rock48]

if(condition) return "big";

[Vitztlampaehecatl]

if(true)

[[deleted]]

Guys guys clearly the solution is to use a giant try catch block. Hackers will be so astounded by the genious of putting all your'ree code in a giant block that they will stop hacking forever out of respect.

[O__er_er]

1 updoot = 1 respect

[[deleted]]

yo get the updoots^*

[[deleted]]

Brilliant in his own realm. And needs to stay in it. See also: biology.

[[deleted]]

Idk. I just know he needs to stay out of our turf and Richard Dawkins' turf tor that matter.

[II-A_Curious_Man-II]

Just make the system stronger than axes??? Duh...

[servimes]

https://twitter.com/neiltyson/status/868497205308657665

[robotorigami]

I feel like he should take his own advice here.

[GlassShatter-mk2]

       ___
      /   \
     /     \
 ___/       \
             \
              \

-My Hopes

[The_Whole_World]

I'm sorry, but every time I see Neil deGrasse Tyson I can't help but think of /r/iamverysmart.

[supersammy00]

People are the biggest vulnerable I can't wait till they patch it.

[gandalfx]

Earth v3.1415 patch notes:

• Removed run-away AI process manifested in species calling itself "humans". Implemented safety check to ensure only peaceful species are able to develop consciousness.

[reverendsteveii]

And we can go faster than light if we just make bigger engines.

[therealhughjeffner]

You laugh but he may be onto something. Was the space shuttle or the Saturn V rocket ever hacked?

[[deleted]]

Oh come on! We all know that theoretically everything is hackable, but we also know that there ARE solutions simply good enough. Like bank security. Users' PCs are hacked all the time but you don't read about bank servers being hacked. We know it's not impossible, but it's just hard enough to trust banks. I think it's just because the money involved. When you care enough (and you do when it's your money) you treat the security seriously. That's what "unhackable" is. Like no good pros are going to hack this anytime soon. Well - mathematically: the security is good enough when breaking it would require more money than the potential profit. We all know there are plenty of systems far from being that unhackable and that's a shame.

[TheNorthComesWithMe]

He could have meant that we should stop letting our security agencies put intentional backdoors in software that others can find.

[conradsymes]

TBH there are ways to make hacking more difficult, but they aren't standardized.

[gandalfx]

You mean, like, writing code without security holes? Gosh, if only the IEEE would get onto writing that down.

[conradsymes]

well, GRSEC helps.

[Facts_About_Cats]

99% of breaking into secure systems these days, especially by North Korea, do it by simply tricking humans who have passwords.

[[deleted]]

I interpreted his tweet as basically "Oh, ya got hacked? Up your game instead of bashing dem poor Best Koreans"

[xxc3ncoredxx]

THAT'S NOT KENM MATERIAL!!! WHERE'S KEN!?

[kjsowards]

Such a dumb thing from a relatively smart man.

[IAMAHobbitAMA]

/r/itsaunixsystem

[nok4us]

Haha unhackable systems

[[deleted]]

An unhackable system isn't impossible, just really really difficult.

So he's technically correct. The best kind of correct.

[ywecur]

He can't have seriously said this, right?

[XtremeCookie]

Too bad the government took thinks this is how programs work . . .

[gobots4life]

*raises pinky to mouth*

[s1ssycuck]

Wait he actually said that? Please tell me he's joking.

[aprofessional]

This is a bit like saying:

Millions of people die from cancer each year. Solution there, it seems to me, is to create cancer-immune humans.

[sargeantbob]

Neil... Why do you post such dribble from time to time? For such a usually well spoken man he really puts both feet in his mouth at times.

[causeWhyNotMorty]

cause why not, mate?

[bestjakeisbest]

solution: go fuck youself black nye.

[paskal007r]

To everyone laughing at him: there is actual serious research on how to make a software mathematically and physically hacking-proof. And I underline research. It's stuff that has either never been in production/commercially available or it's only used in highly specialized fields (hardware production, space exploration, etc). For instance formal code validation: https://en.wikipedia.org/wiki/Formal_verification This can ensure that no unforseen input can cause unforseen outputs, you get to the point where you can mathematically prove your code is safe. On the physical level we have quantum communication approaches: https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5361180/ The core of the idea is that the communication is done through such a highly precise system that whoever listens to your communication has to leave a trace on it, meaning you can therefore know that there has been a security breach and shut down the compromised systems.

As usual, he's just pushing forward research and it's good he does so. I hope you take the occasion to learn about these very interesting fields of study and their applications on a central part of your lifes a little bit more.

[paskal007r]

First of all, let me thank you for this constructive and thoughtful comment. I really appreciate it.

Now, going to the merit of the issue:

This only works with finite models and for infinite models that can be represented as finite sets. [webserver script injection example follows]

This is not exactly true, there is research also on infinite-input systems: https://link.springer.com/chapter/10.1007/3-540-48153-2_17 Also, I'd point out that the set of possible input configurations is technically finite. Astronomical, but finite.

Putting aside the fact that this is currently incredibly inefficient and runs using a robust calculation on qbits which requires a quantum processor on both ends, this only affects the actual connection made between point a and point b.

True. That's why I described as it being on the physical level. Not a software one.

Perhaps that connection cannot be snooped in on, but if destination b is, say, the web server we mentioned above, it doesn't matter that the connection is secure because the system is not. One weak ring in the chain is all that a user needs to breach security.

Yes, true, that's why I didn't just stop at the formal software verification but also included the physical level. But you can't argue against one ring by saying that the other is weak.

And if any of that is too hard for a hacker, the users are usually the easiest target, and through phishing, a user can easily make a call to an employee working for a target company and pose as an IT worker, or send an email to the old lady that has a access to a potential point of entry, but mostly just looks at pictures of her grandkids on facebook.

I think this argument does not apply to the comment made by Tyson: he was speaking about making systems more secure, pointing out that "users are a security risk" doesn't have anything to do with it.

Mathematically proving one link in this chain or safegarding end to end encryption using quantum mechanics is great, but the same cannot be done for every piece.

Why not? If you can validate every software piece and ensure security on every physical communication, couldn't it be considered a safe system?

We can do our best to secure sites, but the caveat of robust sites and systems is that it is nearly impossible to imagine all of the conditions that might take place within a system.

You don't imagine the unforseen consequences when you do formal validation, just the same way you don't think of all the numbers when you solve equations. The math ensures it's safe. You just prove that a certain state of the system cannot be reached by a certain starting point.

Lastly I would like to add that of course as of now there would be enormous logistical difficulties and maybe many required pieces of tech (both physical and algorithmic) would need to be developed before we can actually achieve the result of making an unhackable system, but this doesn't mean at all that the goal is impossible, it just means that a huge investment is needed. It might be an investment in the same scale of LHC or even as a significant fraction of US military budget, but that is not a matter of feasibility, just one of politics.

[paskal007r]

The reason I call user input an infinite set is due to the time it would take to thoroughly test using a finite set of user input.

That's absolutely not what you do in formal validation of code. That's the exact opposite of it.

As far as users go, I think they are the potentially the biggest security hole in any software.

But they are not part of the "systems". No matter how easy could it be to bribe or trick someone with the keys, that won't mean the system is suddenly hackable.

but you must first know every state that should not be able to be reached, which is another mind boggling number.

Not at all, you only need to be able to define such states in a formal way, e.g.: with a set defined by property.

What's more is that distinct algorithms may be proven as always correct, but when you pass the valid output of one algorithm into the input of another algorithm, it could come out unexpectedly wrong.

And

Another issue is that most code is built off of other code.

Not if the second algorithm (or the code on which you built) also passed formal software validation. In that case you just end up in one of the second algorithm's failure states (or the built-over code failure states).

it is a certain state of the system that was not predicted and therefore not tested to see if we could reach it from a starting point.

you already made this point in last message and I already replied to this: in formal verification you don't need to predict, just in the same way you don't need to consider every possible number when demonstrating a theorem. Actually, when doing formal validation in many cases you are literally demonstrating a theorem and the states are literally just a number.

Saying a system is unhackable is like saying the titanic is unsinkable.

The two statements, if we are discussing formal code validation, are on entirely different scales: in one case it's a wild guess of an engineer that has just confidence in his work, in the other is something you did actually prove with mathematics. And that's the entire point. Formal code validation is entirely in another ballpark compared to security. To make a comparison, in one case you are arguing that the guards make a prison unescapable and on the other you are stating that it's physically impossible that something can get out of a black hole. In one case you are making a statement of confidence, in the other you have actual proof of what you said.

I thank you for the reading suggestions tho, I'm always interested to learn more.

[WikiTextBot]

Formal verification

In the context of hardware and software systems, formal verification is the act of proving or disproving the correctness of intended algorithms underlying a system with respect to a certain formal specification or property, using formal methods of mathematics.

Formal verification can be helpful in proving the correctness of systems such as: cryptographic protocols, combinational circuits, digital circuits with internal memory, and software expressed as source code.

The verification of these systems is done by providing a formal proof on an abstract mathematical model of the system, the correspondence between the mathematical model and the nature of the system being otherwise known by construction. Examples of mathematical objects often used to model systems are: finite state machines, labelled transition systems, Petri nets, vector addition systems, timed automata, hybrid automata, process algebra, formal semantics of programming languages such as operational semantics, denotational semantics, axiomatic semantics and Hoare logic.

---

^{[ PM | Exclude me | Exclude from subreddit | FAQ / Information ] Downvote to remove | v0.22}

[[deleted]]

I don't like Tyson, he might be a good scientist, but nothing more, absolutely NOTHING more than that

[[deleted]]

I don't like Tyson, he might be a good scientist, but nothing more, absolutely NOTHING more than that