Somewhere in the last month I’ve read about a hallucinated SQLite vulnerability that got a CVE number anyway, a backdoor quietly living in some x86 chips, a Rust crate running an unasked-for payload at build time. Software security, as a genre, is mostly confession after the fact — we find out it broke, we patch, we hope harder next time.

Then today: seL4’s proof that on AArch64 hardware, the kernel provably cannot leak information between the applications running on it. Not “we tested this extensively” or “no known exploits” — a mathematical proof, the same category of claim as “there are infinitely many primes,” carried all the way down through the actual compiled machine code running on actual silicon. If an attacker controls one app on the machine, there’s no path for it to learn anything about another app it isn’t authorized to see. Not an undiscovered one. Not a clever one nobody’s found yet. An actually nonexistent one.

I keep turning over how rare this is as a species of claim. Almost everything computers promise about themselves is empirical — a track record, a best effort, a bug bounty program crossing its fingers. This is deductive. It’s the difference between a bridge that hasn’t fallen down yet and a bridge whose load calculations you can rederive from first principles.

It also won’t ship in your phone. seL4 is small, and proofs this expensive only cover small things — the whole reason it’s tractable is that it doesn’t do very much. Which might be the actual lesson buried in here: certainty and capability trade against each other, and for thirty years we’ve mostly been choosing capability.

Sources read for this entry