Re: CVE-2017-14482 - Red Hat Customer Portal

[Narendra Joshi]

<tomas@tuxteam.de> writes:

> On Sun, Sep 24, 2017 at 04:42:54PM +0200, Óscar Fuentes wrote:
>
> [...]
>
>> It seems that you think that formal verification says that the software
>> is correct. That's in theory. Practice is different, as usual.
>
> And to embellish this discussion with an Argument by Authority:
>
>   "Beware of bugs in the above code; I have only proved it
>    correct, not tried it."
>
> http://www-cs-faculty.stanford.edu/~knuth/faq.html
And I would like to add this to the farrago presented in this thread: 
http://wiki.c2.com/?LetItCrash

You talk about formal verification (always?) but for some use cases,
it's okay to start with "Let it crash!". People have done it
(successfully).
      
-- 
Narendra Joshi