Regehr's 'Piano Test': would you trust formally verified code with your life?
moyix · x · 2026-10-28
Security researcher moyix RTs a resurfaced 2011 classic by John Regehr (Embedded in Academia), answering the question "can formal verification fully replace fuzzing?"
The thought experiment: if a researcher proves a version of OpenSSH memory-safe, rigs a piano overhead so its rope is cut by the SIGSEGV handler, and lets a fuzzer attack it — would you sit under the piano? Regehr argues few verification researchers would: "verified" is used extremely loosely by the community, and the semantics gap between claimed and actual guarantees is the core problem.
More from coding & agent
- Harrison Chase on self-improving agents: LangChain aims to be the model-agnostic all-in-one platform — hwchase17 · 2026-10-28
- Qiaomu UI plugin gives coding agents 13,561 design references to clone quality landing pages — vista8 · 2026-10-28
- Recurse: open-source minimal research agent harness built on Pi Durable — chaitjo · 2026-10-28
- Going multi-LLM: Sonnet 3.7 for hard tasks, DeepSeek for the rest, which gateway stack? — Extension_Lake4065 · 2026-10-28
- Anthropic prompt tip: give Claude image tools to inspect dense charts and diagrams — minchoi · 2026-10-28
- Give multi-agent teams a time budget: parallel work cut 30 minutes to ~15 — minchoi · 2026-10-28