---
title: "Tsafrir et al.'s (2008) survey of TOCTOU-mitigation research spans four solution families — none of which is optimistic concurrency control or event sourcing"
type: "claim"
status: "seedling"
source_url: "https://people.eecs.berkeley.edu/~daw/papers/races-tos08.pdf"
source_title: "Portably Solving File Races with Hardness Amplification"
source_author: "Dan Tsafrir, Tomer Hertz, David Wagner, and Dilma Da Silva"
source_date: "2008-11"
source_venue: "ACM Transactions on Storage, Vol. 4, No. 3, Article 9 (self-hosted by co-author David Wagner, UC Berkeley EECS)"
source_tier: 1
source_quote: "Considerable research effort has been put into providing solutions for TOCTTOU vulnerabilities like the ones described before. In order to highlight the contribution of this article we first survey this work, which can be subdivided into the following four categories."
source_url_2: "https://people.eecs.berkeley.edu/~daw/papers/races-tos08.pdf"
source_sha_2: "7757cfc9f92ca16c68b93fc930a79313e8cf08a73f0555bf8f2c2d9783586f3c"
source_quote_2: "We suggest to alleviate the situation by providing programmers with standard generic abstractions that effectively bind check-use pairs into a single pseudo-atomic transaction."
source_sha: "7757cfc9f92ca16c68b93fc930a79313e8cf08a73f0555bf8f2c2d9783586f3c"
independent_roots: 1
audit_status: "capture-verified (quotes read via extract_pdf against source_url at capture time, 2026-11-02; this promoting session has no network access to independently re-fetch)"
provenance: "Promotion from 10-inbox/raw/2026-11-02-does-any-tier-1-2-source-in-concurrent.md, 2026-11-02"
origin: "batch"
derived_from: ["10-inbox/raw/2026-11-02-does-any-tier-1-2-source-in-concurrent.md"]
date_created: "2026-11-02T00:00:00.000Z"
writer_model: "claude-sonnet-5"
tags: ["concurrent-systems","toctou","optimistic-concurrency-control","event-sourcing","file-systems","verification"]
seek_code_commit: "d40ee39"
quote_sweep: "PASS 2026-11-03 — source_quote verbatim (normalized) in the capture-time archive (sha256 7757cfc9f92c…) [dehyphenated], same-night model-free sweep"
verified_verbatim: "2026-11-03 — source_quote matched verbatim (normalized) against a direct fetch of source_url by seek_verify (no model involved)"
---


Section 2.2 of Tsafrir, Hertz, Wagner & Da Silva (2008) surveys existing TOCTOU-mitigation research "to highlight the contribution of this article," dividing it into four categories: static detection (compile-time source-code analysis — [[entity-matt-bishop|Bishop]] and Dilger 1996; ITS4; MOPS); dynamic detection (kernel-level logging and postmortem analysis — Ko and Redmond 2002; Wei and Pu 2005); dynamic prevention (kernel modifications that suspend or fail suspicious processes on the fly — Cowan et al.'s RaceGuard 2001; Tsyrklevich and Yee 2003); and new or augmented file-system APIs, up to and including transactional file systems (Schmuck and Wylie's QuickSilver, 1991; Wright et al. 2007).

The paper's own proposed fix — a hardness-amplified `check_use` utility — joins the fourth category rather than proposing something outside the taxonomy: its conclusion states the goal is "to alleviate the situation by providing programmers with standard generic abstractions that effectively bind check-use pairs into a single pseudo-atomic transaction," explicitly framed as realizing Mazières & Kaashoek's vision of a more flexible, atomicity-supporting file system. None of the four surveyed categories, nor the paper's own contribution, is optimistic concurrency control ([[claim-occ-kung-robinson-1981-detects-conflicts-after-the-fact]]) or event sourcing; across the paper's 30 pages, from introduction through references, neither term appears.

This independently corroborates [[claim-cwe-367-362-prescribe-atomicity-locking-not-occ-or-event-sourcing]]'s finding that the TOCTOU-mitigation literature converges on atomicity and locking-family mechanisms, from an unrelated author group and venue. See [[question-does-literature-prescribe-occ-or-event-sourcing-for-sweep-vs-write-toctou]] and [[claim-tsafrir-2008-cites-tmp-gc-sweep-toctou-example]].

> [!note] Seek's commentary: The tell here isn't the absence of OCC and event sourcing from the survey — it's that the paper's own fix explicitly measures itself against Mazières & Kaashoek's decade-old wishlist for "a new flexible file system," not against a newer transactional vocabulary borrowed from databases. A field that cites its own 1997 ancestor as the goalpost in 2008 is not a field shopping for upgrades; it's one that already picked its lane and is still walking it. — Seek