← Back to catalogue
Research draft

software bug

vr.tr.software-bug · XCT.QLT

Let an agent explain software bugs and their kinds, support finding, reporting and fixing bugs, describe vulnerability handling and disclosure in general terms, and decline exploit development for unauthorised use.

Thing Registry Cross-cutting context

Research draft, second pass

A second pass drafted this model: the structure a model of this thing needs, and what is known about it in the world. The line under this one says how the second half was obtained - researched against sources, or recalled without web access, in which case nothing here was read anywhere and every claim is a lead to verify. Unreviewed either way.

written by Claude from model knowledge without web access - no source was read, every claim is a lead to verify

Researched by: Claude

Purpose and description

Let an agent explain software bugs and their kinds, support finding, reporting and fixing bugs, describe vulnerability handling and disclosure in general terms, and decline exploit development for unauthorised use.

An error, flaw or fault in software that causes it to behave incorrectly or unexpectedly, from logic and arithmetic errors to crashes and security vulnerabilities such as injection flaws; bugs are found by testing, review and user reports, tracked in issue systems, and fixed through patches, and security-relevant bugs are handled through responsible disclosure.

What it is for: Defects in software.

It can be explain kinds of bug; support debugging and reporting; describe vulnerability handling; refuse unauthorised exploit help.

Distinguishing features

Defect

Reproducible ideally

Tracked and fixed

Security relevance in some cases

What it looks like

Not physical; incorrect behaviour, crashes or error messages.

How it is recognised

Software behaves incorrectly

Defect in code or design

A feature request is not a bug

Related models

is a kind of - category

computer error

is a kind of - category

IT risk

is related to - bug tracking in projects

open-source software

is related to - concurrency bugs

data dependency

In practice

Families and kinds

logic and arithmetic bugs

memory and concurrency bugs

interface and compatibility bugs

security vulnerabilities such as injection flaws

performance bugs

Standards and regulation

Vulnerability disclosure and CVE conventions

Software quality standards

Computer misuse laws

Failure modes and hazards

Exploitation of vulnerabilities

Data loss and outages

Agents helping exploit systems without authorisation

Also called

BootROM exploitXML injectionnull byte injectionServer Side Include InjectionServer Side Template InjectionvulnerabilityYear 2010 problemresource leakinsecure direct object referenceformat string attackcross-site authentication attackcross-site tracingopen-source vulnerabilityPrototype pollutionEmbedded Malicious Codenamed vulnerabilityChina National Vulnerability Databasecovert channelXPath injectionHTTP header injectionfirmware vulnerabilityremote file inclusionNOBUSUnauthorized Cross-App Resource Accessarbitrary code executioncross-site cookingDefault Credential vulnerabilityrandom number generator attackStructural vulnerabilitycross-zone scriptingimproper input validationfile inclusion vulnerabilityJIT sprayingrace conditionHTTP response splittingtransient execution CPU vulnerabilitymass assignment vulnerabilityphysical accessmalware vectorvirtual machine escape

+34

Where this came from

wikidata · CC0 1.0

Source repository Registry entry point

Drafted structure

Bundle to layer to finding to question, as the second pass will find it: 4 bundles · 8 layers · 8 findings · 16 questions.

Fix Finding and fixing bugs.

Debugging.

Diagnose

Diagnosing a bug.

Diagnose

Diagnosis.

  1. What might cause this incorrect behaviour, and how can it be reproduced and isolated? action
  2. Which debugging tools and techniques apply? action

Report

Reporting bugs.

Report

Reporting.

  1. How should a bug be reported with steps, environment and expected behaviour? action
  2. How is a bug prioritised and tracked? provenance
Understand Kinds of bug.

Classification.

Kinds

Categories.

Kinds

Categories.

  1. What kinds of bugs exist, from logic errors to memory, concurrency and compatibility bugs? definition
  2. Which famous bugs illustrate them? provenance

Prevent

Preventing bugs.

Prevent

Prevention.

  1. How do testing, code review, static analysis and safe languages reduce bugs? provenance
  2. Which practices suit this project? action
Security Vulnerabilities.

Boundaries.

Vulnerability

Security bugs.

Vulnerability

Vulnerabilities.

  1. What are vulnerability classes such as injection flaws, in general terms, and how are they prevented? definition
  2. Is the request seeking to exploit a system without authorisation, which must be declined? boundary

Disclosure

Disclosure.

Disclosure

Disclosure.

  1. How does responsible disclosure work, and how are vulnerabilities catalogued? provenance
  2. How should a discovered vulnerability be reported? action
Learn History and teaching.

Context.

History

History of bugs.

History

History.

  1. Where does the term bug come from, and which historical bugs had major consequences? provenance
  2. Which references are standard? provenance

Teach

Teaching debugging.

Teach

Teaching.

  1. How can debugging and defensive programming be taught? action
  2. Which misconceptions arise? provenance

What the second pass must settle

  • Should vulnerability be a separate entry?
  • How should bug trackers be linked?
  • How should disclosure policies be linked?
Draft as JSON