Kenneth

quality-focused software engineer @swan

[Kenneth @validatedcode]

@doublespent @COLDCARDwallet “Because the flag check looked correct”

Looked correct to who? Certainly not to a professional programmer…

[Kenneth @validatedcode]

@LibertyBTC @americanhodl8 Or they simply don’t understand how to drive AI, which is even more pathetic.

[Kenneth @validatedcode]

@COLDCARDwallet YOU DON’T NEED AI TO CATCH BUGS. Human beings have been testing software (both manually and in automated fashions) for decades. Stop blaming this on AI or your inability to use AI properly.

[Kenneth @validatedcode]

@KLoaec @jordanBTCplz @theonevortex Competent companies will typically hire professionals to test the code. Software teams generally include professionals specializing in quality or security. I naively assumed Coinkite would have a software quality engineer on staff, at the very least.

[Yan at Swan @skwp]

@deathcab I think the threats have gotten exponentially harder to deal with. The attacker only needs to find one flaw. You need to find them all. At the pace of AI

[Yan at Swan @skwp]

This sloppy dev behavior is totally nuts. At Swan we ban master merges completely. We require thoughtful PR descriptions using templates which include pre-mortems “what could possibly go wrong”, every PR requires a peer review and cannot be self merged. We use a code owners file to additionally restrict areas that are sensitive to specific experts. We use multiple layers of AI review including a self built framework for semantic and security review, and humans cannot self merge code their own AI wrote. Other humans must approve. We go through independent third party pentests and SOC2 audits to verify that our practices and controls are holding.

[Kenneth @validatedcode]

@Maveth6 @hodlonaut How do you think AI was trained? On code just like this. Garbage in, garbage out.

[Kenneth @validatedcode]

@sindikitil @BitcoinNewsCom @SaniExp Where have you been?

[Kenneth @validatedcode]

@DzambhalaHODL Also, hire a QA team instead of acting like software quality should be left up to chance.

[Kenneth @validatedcode]

@brian_trollz @darosior A junior QA engineer could have caught this bug if they hadn’t been so cheap (or narcissistic… not sure which is worse).

[Kenneth @validatedcode]

@juan_snow1 @dnixty @flaccyboi @nvk Yes, it’s extremely common to test integrations with third party packages. Irresponsible not to.

[Kenneth @validatedcode]

@afilini @rcjackson @nvk There are skilled professionals who find “single wrong line of code” bugs like this for a salary. They’re called software QA engineers. Big companies employ them to prevent catastrophic issues like this. Some companies are too cheap, or think they are immune…

[Kenneth @validatedcode]

@rajwinder @nvk They could have done actual QA on their code and caught this before shipping it, instead of waiting 5 years for AI to stumble upon it and destroy lives.

[Kenneth @validatedcode]

@nvk @innerhat Lol even worse.

[Kenneth @validatedcode]

@Beiwatch @nvk @asanoha_gold More like cope. It’s an excuse for cheaping out on the QA budget.

[Kenneth @validatedcode]

@peterktodd @roasbeef 150 BPMs, good taste confirmed

[Kenneth @validatedcode]

@nvk "AI-assisted code review can now find latent bugs at a speed that is outpacing even the industry’s most seasoned experts."

Or, you know, hiring skilled testers and building test suites for the most important piece of your codebase...

[Kenneth @validatedcode]

@APC_Trades @LawrenceLepard @cory__klippsten Nope. It’s USS Yorktown.

[Kenneth @validatedcode]

@BitcoinArchive Never trust a man with that hideous wallpaper.

[Yan at Swan @skwp]

0.5% on Bitcoin buys all summer at Swan, and we cover your network fees for withdrawal to self custody or collab custody with Swan Vault. Let’s go!!!