It's the same sentiment as "the typing itself is not the issue, it's the order of the button presses that's difficult."

Of course, by Rice's theorem, all interesting questions are undecidable anyway...

No it doesn't. But as a human being, you and everybody still deserves a decent living. And our current system clearly does not provide that for a lot of people.

Sure it does. Our species is social, meaning we form societies for evolutionary success. Both of us being members of that society, it is in my interest to see your child survive. It is a tragedy to think your child may not survive because human greed prevents them from accessing resources we have in abundance.

The opposite perspective is anti-social in a literal way: the greedy cannot use all of the resources, can't eat all of the food; they want control so you can't have it without their permission. You are entitled to eat, seeing as we have more than enough to feed you. That others think you are not is disagreeable, to put it mildly.

Even in a tribe, there’s a lotta suffering and very little remorse for it.

We may say we chase a society that would see everyone understand the principle of ‘your child should also get a decent life’, but what we see now, across nearly all societies is really the opposite. And it phrases like this - we don’t care if your children live or die for as long as our children get better chances.

This statement is rather plainly not true. It describes child rearing and claims it does not happen in one breath.

There is a concept of "fairness", which I don't want to discount, but there's not much of a history of people being bottom feeders who do nothing to help those around them. Sure, there's a lot of sentiment to that effect but it is somehow something I fail to observe to this day. It is in the eye of the beholder and I worry for the souls of the beholders who judge so harshly.

This idea that someone is not deserving of food because they have not earned it a sad, anti-social thing to believe, perpetuated by psychological attacks from those who have more than they could ever need. You and your children deserve to eat and disagreement with that statement says more about the one disagreeing than it does any other, regardless of the judgement inherent to the nature of the disagreement (really, because of it, I suppose).

kind of the point of living in a civilized society i reckon

It's been so long since we've seen actual bread riots I fear we forgot how nasty those are.

I think the notion is that with new automated systems of violence and control, some of them built onto the people themselves, our "future civilization" can dial back the worker's compensation to below subsistence. There was a big zillionaire conference where they talked about slave collars, for example, or humanoid AI workers. I'm always a little distressed when the masters of industry fall back on science fiction in order to build a machine that needs to function in the, well, in the present.

[1] One person's output in terms of agriculture

What? Do you have a link?

It was a private 2017 desert retreat where five wealthy tech and hedge-fund investors flew out media theorist Douglas Rushkoff, ostensibly for a speaking engagement.

Rushkoff wrote it up first as a Guardian essay and later expanded it into his 2022 book Survival of the Richest: Escape Fantasies of the Tech Billionaires.

The problem's super duper obvious if you studied history, but it is also pretty obvious if you can think about second order effects. In collapse the wealthy obviously need security forces to hold on to their stuff, but in a collapse your stuff will - presto changeo - become the security force's stuff. Essentially the singular founding story of all European royal families. Barbarian general took the house, banged the wife, now he's king. Or King-Sound. Kai- Zar

At the end of the day all these little lords and lordettes figured out the time honored lesson that to be actually safe you want to make friends with the locals. And that's part of being new king types as well. But "making people like you" isn't a popular notion with the Revenge of the Nerds types who love this "Lord of the Bunker" kind of thing.

I've seen zoo chimpanzees make a mockery out of this sort of device in VERY short order, and I would dread to impose it on a Delta Force psychopath who also has more higher degrees than I do. Because he's going to know who it was who did it and have all sorts of ideas about what he's doing about that. So the basic premise is also idiotic.

Sorry, I was a little more snide than I usually am on HN, it's been a long day.

So, yes, in order to have a society one perhaps and most likely needs to define how rights are guaranteed. But it does not mean anyone is entitled to it by definition. Otherwise millions of dying children throughout modern history, and now also, would see the perpetrators get a ‘fair’ treatment. But they don’t.

Perhaps only as second order effects that are hard to understand and are not entitlement.

I'm not really sure how your reasoning here is in line with your previous post.

It can be circular.

MS invests 5 billion in OpenAI.

OpenAI invests 5 billion in MS.

Do we have 10 billion now?

I want my son to live on a livable planet, and not under the constant threat of destitution. And I want that for all children, not just mine.

There's more to life than one's material standard of living. I think people were mostly talking about the other bits.

High trust societies, a feeling of place and well-being in a culture, connectedness, etc.

https://data.worldhappiness.report/map

Note: Look at the US continuing to move down the report year after year.

By Rice's Theorem, I somehow doubt that.

If dataflow is not provably connected from source to sink, an alert is impossible. If a sanitization step interrupts the flow of potentially tainted data, the alert is similarly discarded.

The end-to-end precision of the detection depends on the queries executed, the models of the libraries used in the code (to e.g., recognize the correct sanitizers), and other parameters. All of this is customizable by users.

All that can be overwhelming though, so we aim to provide sane defaults. On GitHub, you can choose between a "Default" and "Extended" suite. Those are tuned for different levels of potential FN/FP based on the precision of the query and severity of the alert.

Severities are calculated based on the weaknesses the query covers, and the real CVE these have caused in prior disclosed vulnerabilities.

QL-language-focused resources for CodeQL: https://codeql.github.com/

Is CodeQL special cased for your code? I very much doubt that. Then it must work in the general case. At that point decidability is impossible and at best either false positives or false negatives can be guaranteed to be absent, but not both (possibly neither of them!)

I don't doubt CodeQL claims can be demonstrably true, that's still coherent with Rice's theorem. However it does mean you'll have false negatives, that is cases where CodeQL reports no provable claim while your code is vulnerable to some issues.

Clearly it is still possible to generate a false positive if, for example, CodeQL’s algorithm thinks it has found a path through the code where unsanitised user data can be used dangerously, but in fact there was a sanitisation step along the way that it didn’t recognise. This is the kind of situation where the theoretical result about not being able to determine whether a semantic property holds in all cases is felt in practical terms.

It still seems much less likely that an algorithm that needs to produce a specific demonstration of the problem it claims to have found will result in a false positive than the kind of naïve algorithms we were discussing before that are based on a generic look-up table of software+version=vulnerability without any attempt to determine whether there is actually a path to exploit that vulnerability in the real code.

Looking at the docs, I’m not really sure CodeQL is semantic in the same sense as Rices theorem. It looks syntactic more than semantic.

Eg breaking Rices theorem would require it to detect that an application isn’t vulnerable if it contains the vulnerability but only in paths that are unreachable. Like

    if request.params.limit > 1000:
         throw error
    # 1000 lines of code
    if request.params.limit > 1000:
         call_vulnerable_code()

It’s probably demonstrably true that there is syntactically a path to the vulnerability, I’m a little dubious that it’s demonstrably true the code path is actually reachable without executing the code.

I was also missing mentioning "sideways information passing", though some of methods are exactly that.

I am wondering whether the company consults literature or whether they fiddle about, mostly reinventing the wheel.

ABCDE, to insert 1 after C: store D, overwrite D with 1, store E, overwrite E with D, write E.

basically SSO (or a twist of it)

* Reverse polish notation

* Chinese remainder theorem

* Byzantine generals problem

If anyone ever referred to Apps Hungarian that would be "Simonyi's Wish For A Proper Type System", but nobody ever does.

So I had quite a few "groundbreaking" approaches end in disappointment.

It's important to know the capabilities and limits of your tools.

I did some property-based testing in Haskell and in some cases the implementation was the specification verbatum. So what properties should I test? It was clearer where my function should be symmetric in the arguments or that there is a neutral element, etc..

If the property is basically your specification which (as the language is very expressive) is your implementation then you're just going in circles.

I find that most tutorials talk about "properties of function `foo`", whereas I prefer to think about "how is function `foo` related to other functions". Those relationships can be expressed as code, by plugging outputs of one function into arguments of another, or by sequencing calls in a particular order, etc. and ultimately making assertions. However, there will usually be gaps; filling in those gaps is what a property's inputs are for.

Another good source of properties is trying to think of ways to change an expression/block which are irrelevant. For example, when we perform a deletion, any edits made beforehand should be irrelevant; boom, that's a property. If something would filter out negative values, then it's a property that sprinkling negative values all over the place has no effect. And so on.