The presumption that computers are working correctly

My usual presumption is that the computers are not working correctly, as I've seen way too many cases where they in fact are not working correctly. I don't even believe Google Maps when I'm driving, I always sanity check the route and double check street names/exit numbers when it tells me to turn. I've been burned too many times.

"Code is law." -Lawrence Lessig

The UK apparently made that explicit. Doubtless others have as well: if we could forego the flag waving and whataboutery, That Would Be Great (tm).

How does that work? I'm not a lawyer. I'm a lazy programmer.

So, does the defense get to subpoena the logs, and depose a programmer to explain why some random request returned a 502?

Does the defense get, like, red team access?

Although I'm a lazy programmer, I do think a lot about failure modes. If my freedom is on the line, I can probably think up a few (orders of magnitude) test cases. Happy to provide a shell script or python or golang binary to check. Heck, if it comes down to it I'll provide a stack of fortran cards. Do I get to see the source? That "few" is probably going to move a decimal place or 5.

I get volume is not reasonable in the eyes of the court. Scale is how you(I) find problems, but whatever. Gimmie source, gimme access, I doubt I could beat Knuth, but with my freedom on the line I could give him a run for his money.

How do CVE's count? If I find evidence of log4j do I auto win?

This makes me think of the Jepsen tire fire talk. The system probably mostly right. But there's no way it's correct. What's a "fair" level of access to prove that?

a 1984 law