UP | HOME
Boudica Security

Reproducibility and determinism

"Reproducible"

In science, [reproducibility] is being able to run the same experiment or process and get the same result each time. We also say it is replicable or repeatable. Mathematically we may say such a system is deterministic. In engineering it's a most basic requirement for rigour, formality and often undergirds safety.

In code compilation a reproducible source-code base always compiles to identical machine code (binary). This means it can be hashed (fingerprinted) and the end user has a high confidence what they execute is what is in the source code (even if it was compiled by a third party). This is an essential component of supply chain security.

A system without this property gives different results each time it is run, despite starting under identical conditions (with the same starting state and input variables). We might call this an unstable, unpredictable or non-deterministic system. In code, a non-reproducible build gives different binary outputs from the same source code. This means malware can be hidden in proprietary binary code (blobs) from third parties.

Experiments in fringe sciences like telepathy and homeopathy have very low reprodicibility. It does not mean there is no basis or truth in those pursuits, but that we don't understand them and have no reliable, predictive model. Most neural "generative AI" is non-reproducible. Developers and users have a very poor understanding of what it's doing. It should never be used in safety critical systems such as aviation or medicine.

One of the reasons we recommend BSD is because of its highly reproducible assurance.

One of the reasons we recommend simple modular systems according to the Unix Philosophy, is that low cyclometric complexity correlates with stable and predictable software.


Boudica Security Home   Call: Office +44(0) 1202 022249   Mobile, SMS, WhatsApp: +44 (0) 7555899518   Email: info at this domain. public key