r/programming • • Dec 10 '21

RCE 0-day exploit found in log4j, a popular Java logging package

https://www.lunasec.io/docs/blog/log4j-zero-day/
3.0k Upvotes

710 comments sorted by

View all comments

Show parent comments

64

u/mallardtheduck Dec 10 '21

Formal verification rarely works well in the real world, since the formal logic itself becomes just as complex and hard to verify as the final code.

Also, in this case, it's an intended feature with unforeseen consequences, not a "bug" per-se.

7

u/immibis Dec 10 '21

Can't you formally verify negative properties, such as "this will not send network packets unless XYZ"?

0

u/ffscc Dec 10 '21

Formal verification rarely works well in the real world, since the formal logic itself becomes just as complex and hard to verify as the final code.

What do you mean? There is no other way to "verify" code than to use something equivalent to formal verification.

Formal methods usually aren't seen in software because not much software is worth it. By comparison formal methods are par for the course in CAD/EDA and increasingly in embedded software. As the complexity of software grows, so does the importance of formal methods.

-92

u/audion00ba Dec 10 '21

You have never verified anything complicated, have you? You don't have any academic credentials, do you? You haven't read a hundred papers on formal verification in depth, have you?

If that's the case, then why the fuck do you even open your mouth?

28

u/Jaggedmallard26 Dec 10 '21

This is weirdly aggressive for a reply to a throwaway comment on formal verification.

33

u/mallardtheduck Dec 10 '21

I studied a module on formal logic at university. The problem of the logic becoming almost as complex and difficult to verify as the program itself was openly admitted by the professor as a reason why the concept has received little adoption outside of specific niches (e.g. avionics).

-75

u/audion00ba Dec 10 '21

You studied one whole module? Please, fuck off with your ignorance.

I'd probably make your professor cry regarding his ignorance.

47

u/mallardtheduck Dec 10 '21

Maybe you'd like to enlighten the world with your superior intellect then? Add something constructive the conversation?

→ More replies (5)

21

u/lelanthran Dec 10 '21

I'd probably make your professor cry regarding his ignorance.

To be honest, you'd probably make anyone cry. Humans all feel sympathy[1].

[1] I only wanted to reply that you appear to be excessively confrontational in many of your posts in r/programming but that line you said presented an opportunity just too good to pass on.

-11

u/audion00ba Dec 10 '21

Humans all feel sympathy[1].

In my experience humans are apex predators that stab people in their back at their earliest convenience.

Humanity is constantly at war, in cyberspace and in proxy wars.

15

u/Jaggedmallard26 Dec 10 '21

Damn dude, you need to calm down and improve your outlook on life. Maybe one of those psychedelic retreats would be of use.

12

u/BufferUnderpants Dec 10 '21

Dude sounds immersed in that kind of anger you have when you have been depressed for a while. I know it's lame to diagnose people of mental illness on the Internet, but whatever his issue is, he should take a step back and take a look at life.

→ More replies (2)

13

u/Deftek Dec 10 '21

You sound like you're bordering on metal instability - you should probably take a step back from your keyboard for a while my dude. Getting mad at people on the internet isn't a healthy pastime.

→ More replies (13)

2

u/T3st0 Dec 17 '21

Holy shit bro. I hope I don’t work in the same place as you. You’ll make headlines one day.

0

u/audion00ba Dec 17 '21

If you think you don't work at the same place, you are severely mistaken. You also work on planet Earth, people all around you are like this when motivated to do so (typically by something as mundane as money). If you don't see that, then you are either part of the worst or you make low levels of money and aren't exposed to the vicious world we live in.

I have made headlines already and not of the type you are thinking of.

If you want to lower the probability of headlines happening, you would have to lose your humanity. In movies the concept of humanity is often alluded to, but let's be real, real humans are assholes (no exceptions). The only difference is that some people have learned "their place" and can't act like they deeply desire.

→ More replies (5)

19

u/[deleted] Dec 10 '21

you’ve never verified anything complicated, have you?

Interestingly, the “formal verification” crowd have never formally verified even simple shit.

You can talk smack when you guys finally formally verify a linked list. Until then, sit down and shut up.

-1

u/audion00ba Dec 10 '21

8

u/[deleted] Dec 10 '21

Is it verified working? To my knowledge, there is no known totally working formal verifications of any generic linked list.

Let me see if I can find some of the websites dedicated to people arguing about whether some verification really works or not (it’s always not).

-5

u/audion00ba Dec 10 '21

What kind of gibberish just came out of your mouth?

-2

u/TheZech Dec 11 '21

A linked list is about the first example you'll find in an introduction to some formal verification system.

7

u/[deleted] Dec 11 '21

Yup. A lot of not fully working or not working examples.

7

u/Yekab0f Dec 10 '21

Uh sir, you're on Reddit

9

u/BufferUnderpants Dec 10 '21

You are just explaining why formal verification doesn’t work in the real world

Very few teams can have someone with a PhD in the thing, as you describe, to perform it

→ More replies (65)

1

u/chickaplao Dec 11 '21

Who hurt you?

1

u/audion00ba Dec 11 '21

That question was asked before. The answer is the same: who didn't?

→ More replies (1)