Why we have buggy software

"You will find that a good group of adults has a lot more kindness, understanding, tolerance and forgiveness than a similar group of teenagers. I think the reason for this is because adults understand that they are fallible. All adults have made mistakes, they have all tried to do things and had them not work out, and they all know how that feels. Therefore, they cut each other a lot more slack. It is a much happier environment."

Marshall Brain, The Teenager’s Guide to the Real World

Lots of classic papers are full of grammar and spelling errors. Diffie and Hellman's classic paper "New Directions in Cryptography" has its share of errors. So does Dijkstra's "Go To Statement Considered Harmful." Some of these errors are so obvious that you sometimes end up wondering how they could have been overlooked. That's until you actually try to write something yourself.

That's when you learn that what you write tends to reproduce a sampling of your thought process. When you try to edit what you've written, what you see then seems to reconstruct this thought process. This means that you see what you were thinking instead of what's actually in front of you, which makes it very difficult to edit what you write. It often takes quite a while away from something that you've written to get your mind into a state that's different enough from its original state so that you avoid this problem.

Writing anything involving a significant level of mathematics is even worse. And it's even more difficult to edit. It seems that your brain does lots of pattern matching on mathematics. "Ah," it thinks, "that's just calculating an autocorrelation. I know what part's doing and I can move on to the next section." And when it does this, it's even easier for mistakes to get incorrectly overlooked. Spellcheckers have made it easier to find some spelling errors, but they've also made us lazy, and we’re now probably much less likely to see an error unless it's underlined in red.

Writing software seems to be plagued by a similar problem. If you think through a feature before writing software that implements it, you often find that debugging the software is often unnecessarily difficult because your brain assumes that what you wrote does things correctly, even though it doesn't. Some of these bugs turn into security flaws that appear in the National Vulnerability Database. And just like you might first be astounded that so many errors creep into writing, you might be tempted to be surprised that so much buggy software can be released in shipping products. Lots of these bugs are probably overlooked because our brains make too many assumptions or the wrong assumptions when looking at the source code. If you’ve written software, you probably understand this.

So we may be stuck with bugs in software and the security vulnerabilities that they cause. The only way to get rid of them may be to have software written and debugged by something other than a person, and I don't think that that will be happening any time soon.