Hacker News Reader

Comment by forgetfreeman | Hacker News Reader

Pretty sure I'm going to burn some karma on this one but what the hell.

To the best of my knowledge there is no evidence in over four decades of commercial software development that supports the assertion that software can be truly secure. So to my mind this suggests the primary villains are the individuals and organizations that have pushed software into increasingly sensitive areas of our lives and vital institutions.

View on HN

As someone who thinks the industry should professionalize, I actually agree with you somewhat; we pushed too far, too fast, and into territory that software has no business being in.

What's the definition of truly secure?

The world economy is hemorrhaging over a trillion dollars USD annually to cybercrime, so however you choose to define it it clearly doesn't exist.

If you defined it as absence of runtime errors, it exists.

Even if that's true (massive if) it's a meaningless assertion. You've still got to deal with several tiers of hardware vulns, the OS space, and figure out a way to provably secure any network traffic generated. "hello world" tends to be pretty secure in theory but it isn't particularly useful.

It's not meaningless because relevant security issue arise from runtime errors. These can be completly fixed by using Ada/SPARK or Rust. Hardware vulns are for many systems not very important.

LOL The Rust Evangelism Taskforce has entered the chat

I don't use Rust. And you have no single argument.

points at the aforementioned forest fire of money You have a way to put that out all of the best funded companies on the planet and just about every sovereign government would be kicking your door in. That's my argument. Observed results trump hypotheticals.

That does not make sense.

I assure you it does.

Reply on news.ycombinator.com