TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

SMT Solvers in Software Security (2012)

80 pointsby SE_Studentalmost 6 years ago

4 comments

nickpsecurityalmost 6 years ago
If for verification, I&#x27;ll add this trifecta some of us independently arrived at:<p>1. Formal specs drive spec&#x2F;property-based testing for quick verification.<p>2. If that passes, try to get automated proof with the solver.<p>3. Use formal specs as runtime checks or traces that get checked with the input being from fuzzers or other test generatore. Failures take you right to the property that failed.<p>4. Optionally, leave runtime check in for any specification property that is unproven or lacking resources to prove.<p>Also, static analyzers that quickly catch certain kinds of problems. If available, I&#x27;d run them in parallel to the property-based testing <i>before</i> the proof attempt. All this together keeps time&#x2F;effort minimized with productivity on verified code maximized.
评论 #20546659 未加载
gbaconalmost 6 years ago
Paper: <a href="https:&#x2F;&#x2F;www.usenix.org&#x2F;system&#x2F;files&#x2F;conference&#x2F;woot12&#x2F;woot12-final26.pdf" rel="nofollow">https:&#x2F;&#x2F;www.usenix.org&#x2F;system&#x2F;files&#x2F;conference&#x2F;woot12&#x2F;woot12...</a><p>Slides: <a href="https:&#x2F;&#x2F;www.usenix.org&#x2F;sites&#x2F;default&#x2F;files&#x2F;conference&#x2F;protected-files&#x2F;vanegue_woot12_slides.pdf" rel="nofollow">https:&#x2F;&#x2F;www.usenix.org&#x2F;sites&#x2F;default&#x2F;files&#x2F;conference&#x2F;protec...</a>
ghayesalmost 6 years ago
We’ve been using Certora for smart contract code verification. For me, it’s really amazing to see effective code verification can be (on small and important code routines). Over time, I expect code verification to overtake unit testing for core (pure) code modules.
apaprockialmost 6 years ago
Aside: Should have a 2012 in the title. I recognized Julien’s work because he came to Bloomberg almost immediately after this :)