lilott8

You can actually classify mosquitoes and other insects by wing flapping. Time series is a perfect application for things like this.

There are certain things that are, collectively, patently negligent: storing passwords in plain text, not salting passwords, not using, at a minimum, software firewalls, etc. Those are fairly boolean. It's also fair to assume that any company that is hit with a 0-day is not negligent; even the best prepared companies are susceptible to them. So there is some decent guidelines to rely upon to demonstrate negligence or not on the extremes. Of course, in the middle it does, admittedly a bit gray. But the teeth that come into play would look exactly like GDPR.

Yes, I agree completely, that C-levels will see that the CISO is a replaceable widget that is nothing more than a scapegoat.

I would envision this system to be something such as:

We have a set of standards that define what negligence looks like for data breaches, security, etc. If a company is found to not adhere to these standards they would be found negligent and assessed some financial penalty.

If a company is found to be adhering to the standards, and is hit by a 0-day, the financial penalty would be negligible or 0.

How is this enforced? For facebook, let's say, is all I have to do is change my country from a non-European country to a European country, and I'm good? Because that is a fairly easy line to cross.

How does this not apply, in any way: https://en.wikipedia.org/wiki/Software_copyright#History_of_...

I don't understand how this is never brought up with regard to API copyright. API's are software, software has been deemed copyright-able, thus, API's are copyright-able.

Am I going crazy or missing something?

Its only been alluded to, a time or too, but never explicitly stated (unless I missed it). But, sleep. Getting >=7 (preferably 8+) hours is paramount. (Also, just about everything else listed in this thread).

To address your specific concerns regarding "learning the maths": that's a bit disingenuous from the people stating it. It is actually logic they are talking about, rooted in the discrete math branch. For seL4 you can actually read the proofs and their conclusions: http://sel4.systems/Info/FAQ/proof.pml. It's a lot of (structural) induction style proofs. That page will be a good starting point and just google around for missing holes as you need.

That is a great counter example. I expect there to be a slow migration to platforms like [this formally verified microkernel](https://sel4.systems/). This will take time and a tremendous amount of effort. But will ultimately address the counter example. In the conclusion of this migration, this puts the SE field into line with the rest of engineering.

Choosing the constraints for a project is no different in the context of CS than the context of any other fields -- electrical, mechanical, etc. It is a conversation, as you stated. This helps in many ways: it helps the developer understand exactly what the client wants, helps the client understand exactly what they are going to get, and helps build an implicit timeline replete with discrete and obvious deliverables and (if done correctly) those deliverables are fairly modular.

Thanks! I, too, get frustrated that people just say 'math! math! math!' That isn't helpful or meaningful. This is a conclusion I came to after talking to quite a few of my friends and colleagues in different engineering disciplines.

Yes and no. It is a natural progression of the industry. Those who cannot do "formal engineering" probably don't belong in engineering roles. Engineering, in general, imho, can be distilled down to this: Clearly define the constraints in which your project will operate under and prove that they will hold under those constraints. If someone as an SE cannot do that, they really have no business being anywhere near any field of engineering.

I wouldn't say I've underestimated anything. That was an honest question; as in: "what mental gymnastics did the FCC do to even think that keeping secrets is allowable?"

That aside, I would agree with you.

Not only that, in what way does an independent agency having zero ties to national security or the IC have any right to hold just about* anything secret? This is asinine!

what you are suggesting has grave realities for those who cannot or do not want to mess with formal verification techniques. This is the future of computing and a lot of people will be left behind once this catches on.

JetBrains has something that is similar to this: MetaProgramming System (MPS)(https://www.jetbrains.com/mps/). It resides exclusively within the context of Java (so DSL) -- so it's not as, shall we say, far reaching as Graal and Truffle claim to be?

It works really well though; abstract the complexities of the AST through the use of various different methodologies so that designers can do what they do best, design. The shortcomings, I'd imagine, are the same with MPS in-so-much that the limitations imposed are defined by the system. And when you run into those boundaries, they are hard and unforgiving -- much like trying to use Python in a non-pythonic manner.

why would they? I mean with how they are charging by the GB these days, it gives them financial incentive to not tell you your refrigerator (or any device) is part of a botnet, that's free money for them.

Nope, it doesn't. Even using their own metrics they are abject failures: http://www.latimes.com/opinion/topoftheticket/la-na-tt-tsa-a...

http://www.huffingtonpost.com/2015/06/01/tsa-fails-95-percen...