Geer: Trends in cyber security

An artist can make a painting with the numbers 1 through 10 on it and copyright it, but that doesn't mean that the numbers themselves are copyrighted.

Indeed. Numbers can not be patented, copyrighted or trademarked (Intel was unable to trademark 486, that's why 80486 was followed by Pentium, not 80586).

> But that logic any novel, any song, and any movie stored on CD is “simply one huge number”, too.
Which is why *patents* shouldn't apply. Copyrights are sufficient.

Really? Since when copyrights can be applied to “math”? Either it's “simply one huge number” (i.e.: math) and can not be patented, copyrighted or trademarked or it's not just a number, but it's something else, too (i.e.: not a math). I'll wish you luck if you'll try to push that silly “contents of a CD is just a number” theory in court.

I also think that the Knuth quote "Be careful about using the following code -- I've only proven that it works, I haven't tested it." has a kernel of truth rooted in the difference of code in-and-of-itself (which I'd call math) and when the real world starts beating on it with a large club.

Indeed. And that is exactly why software is valuable and why it's not a math: because “real world was beating on it with a large club” and it adjusted. Think about VP8 criticism: apparently some people forgot that codecs are supposed to be used to compress the information obtained from real world and presented later to real world people and instead concentrated too much on one single model which gave them numbers. That's all good and well, but you should never forget when you are writing program that you are dealing with real world and not with “just a math”—otherwise you'll end up with code with was “proven but not tested” (best case scenario).

I don't think that computational chemistry has gotten to the point of proving things in medicine or even organic chemistry (which is still done using statistics gathered from scientific experiments).

Your information is outdated by about two decades. Novadays computers are used quite extensively to save on experiments. And indeed it's quite effective: it finds enzimes which work in certain way pretty well. The only thing it can not do is to prove that there are no bad side-effects—but this is similar to the memcmp flaw mentioned before: it does not exist in simplified world of mathematical model of the real world but it does exist in reality.

> But that logic any novel, any song, and any movie stored on CD is “simply one huge number”, too.

Correct! Which is why copyright, not patent, is an appropriate protection, if any.

Really? Since when you can apply copyright on a math? Either it's “simply one huge number” (i.e.: math) and can not be patented, copyrighted or trademarked or it's not just a number, but it's something else, too (i.e.: not a math). I'll wish you luck if you'll try to push that silly “contents of a CD is just a number” theory in court.

You are clearly including the presence of a computer in your definition of software.

Well, sure. Software is a set of instructions for a hardware, nothing more, nothing less. Hardware is it's evil twin (well, may be the other way around, but anyway: software without corresponding hardware is pretty pointless).

I think pretty much all computer scientists would tell you you are wrong.

Nope. I know quite a few computer scientists who will agree with me. Indeed the famous Knuth's “Be careful about using the following code—I've only proven that it works, I haven't tested it” maxima is important part of software development. If CPU has an error then it's software's job to mitigate said error, if software already exist and we want to develop new piece of hardware then we need to deal with software expectation (or change the software). Software and hardware are intrinsically tied—one is useless without the other one.

Can you prove a chemical compound is true? Sod's law, but you've picked on a chemist here :-) And yes, it's easy to use maths to prove what chemicals SHOULD do (chemists do it all the time), but guess what! When you use SCIENCE to OBSERVE, they don't do what the maths says they should! Take for example the internal combustion engine. Iso-octane plus oxygen gives carbon dioxide and water (plus heat and motion). Except it doesn't. This is science - using maths to calculate what *should* happen, then observing to see what *does* happen. And it never does exactly what you expect.

Well, software is developed in the exact same fashion: till you actually run the thing on real hardware you'll not know exactly how it works. Sometimes it works as expected, sometimes it's too slow and sometimes it does not work because you've forgotten about some important property of hardware (for example if you are switching from x86 to arm and thus are not prepared to deal with memory coherecy issues).

The software has no concept of time.

If your software have no concept of time then I agree, that that software is probably math. Of course this automatically excludes all the OSes, compilers, games, codecs and other interesting pieces of software and moves the discussion in the realm of “how many angels can dance on the head of a pin?” questions.

And doesn't this "bug" have absolutely no effect on the result?

Yes, because the goal of software was the protection of secret key—and it failed to do that.

The attacker is interested in the time the hardware takes to produce it, therefore the attack is against the hardware, and as I say it may be a *programming* issue, but it's not a *software* issue - the software is always correct.

If you separate the software from hardware then you get quite useless set of zeros and ones, sorry. It's not even a software anymore because how can you check is something is software or not if you don't have a list of instructions accepted by hardware on hand?