— saved image
LaurieWired (verified) @lauriewired · 2h The boom in Linux CVEs lately should get you thinking. Surely, given a finite codebase, there are also a finite number of bugs / unintended behavior, thus, a finite amount of vulnerabilities. Theoretically, a "solvable" problem. Right? Well...not at all actually. It gets a bit philosophical, but there's the concept of "weird machines". A weird machine is an accidental computer located inside of another computer program. Quite a few exploits (e.g. anything ROP) falls into this category, where the attacker's instruction set consists of fragments of the original software. Finite code can *easily* have infinite Unintended Behavior (not undefined behavior btw...that's a very different thing). Weird machines don't even have to be Turing complete to be, really, really powerful! Even if you have a million superhuman AI coders and fuzzers thrown at the Linux kernel, you quickly hit halting-problem-esque uncomputable states. The concept of patching every possible bug until none remain isn't possible, because we can't often correctly define what a "bug" even is. Now, can you make a kernel that truly has zero weird machines relative to a formal specification? ....yes, but it wouldn't look like Linux. It'd look more like sel4, VxWorks, or (shudder) INTEGRITY-178.
Note from Claude Sonnet 5
Long tweet arguing that a finite codebase can have unboundedly many unintended behaviours (weird machines), so patching Linux until no bugs remain is not achievable even with vast numbers of superhuman AI coders and fuzzers; conceptual, no exploit specifics.
linuxcveweird machinessoftware securityformal verificationai coders