3 ms·

You may not be familiar with reading and writing C. String parsing in ANSI C in the 1980s looked like this. And it is completely readable and obvious to those w

You may not be familiar with reading and writing C. String parsing in ANSI C in the 1980s looked like this. And it is completely readable and obvious to those who are well-versed in the language and practices of the time. For example, those naming practices were pretty essential when working with 80-character monitors. And all those ifdefs were required for dealing with DEC minicomputers and (later) microcomputers. A minicomputer, if you didn't know, was something that in terms of power and cost existed between a mainframe and microcomputer (i.e., a PC). Breaking out the code into different functions by platform (segmented by ifdef statements) would create unnecessary code bloat unless the implementations differed significantly. And believe it or not, this was much more readable (with the technology of the time) than calling separate functions within a master function, requiring referring to each function separately. Of course, ifdefs for different platforms are still required, and are often used in a similar way today. I guess what I'm trying to say here is that there were very practical and pragmatic reasons code used to look like this, and that things much more obscure and (to modern eyes) hard to read were written by very smart people who knew exactly what they were doing.

pcwalton 11y ago
To be fair, though, those smart people routinely wrote exploitable buffer overflows with code just like this (and "smart people" here is not sarcasm--they were smart!) C string handling may have been defensible 30 years ago (though I'm not sure about that), but not today.
- ArkyBeagle 11y ago
  It wasn't defensible 30 years ago, either. I say that - may be I led a charmed life. Sigh.
- TheCondor 11y ago
  You say that as if we don't have people writing buffer overflows and other exploits in C today.
- mratzloff 11y ago
  Yep, you're absolutely right--but it was a time when the entire world wasn't networked to the degree it is today, and there was little or no motivation for someone thousands of miles away to gain access to your system. Security was simply less of a concern for most programmers, so much so that it often didn't even occur to them. Until the mid-1980s, even US federal law and its enforcement reflected that. Saying it is indefensible to manipulate strings in C is coming pretty close to saying it is indefensible to use C (and after they went to all that work to put together C11!). For most programmers, perhaps. But it still has its uses, and as of C11 safer standard string manipulation functions, as well. A competent, security-minded C programmer can write perfectly safe string handling code in modern C. Still, it wouldn't be my first choice. A Jedi may use a lightsaber effectively, but a novice will probably just end up cutting off his leg.
polishninja 11y ago
Thank you for the insightful comment. Too often I have worked with developers that assume the original programmer was being difficult, didn't understand how to write proper code, or was inexperienced. They precede to rip out the code and re-write it "their" way. When I come across code I don't understand I base my assumptions on the belief that the original programmer was smart, knew what they were doing, and had specific reasons writing the code as such.

pcwalton 11y ago

To be fair, though, those smart people routinely wrote exploitable buffer overflows with code just like this (and "smart people" here is not sarcasm--they were smart!) C string handling may have been defensible 30 years ago (though I'm not sure about that), but not today.

ArkyBeagle 11y ago
It wasn't defensible 30 years ago, either. I say that - may be I led a charmed life. Sigh.
TheCondor 11y ago
You say that as if we don't have people writing buffer overflows and other exploits in C today.
mratzloff 11y ago
Yep, you're absolutely right--but it was a time when the entire world wasn't networked to the degree it is today, and there was little or no motivation for someone thousands of miles away to gain access to your system. Security was simply less of a concern for most programmers, so much so that it often didn't even occur to them. Until the mid-1980s, even US federal law and its enforcement reflected that. Saying it is indefensible to manipulate strings in C is coming pretty close to saying it is indefensible to use C (and after they went to all that work to put together C11!). For most programmers, perhaps. But it still has its uses, and as of C11 safer standard string manipulation functions, as well. A competent, security-minded C programmer can write perfectly safe string handling code in modern C. Still, it wouldn't be my first choice. A Jedi may use a lightsaber effectively, but a novice will probably just end up cutting off his leg.

polishninja 11y ago

Thank you for the insightful comment. Too often I have worked with developers that assume the original programmer was being difficult, didn't understand how to write proper code, or was inexperienced. They precede to rip out the code and re-write it "their" way. When I come across code I don't understand I base my assumptions on the belief that the original programmer was smart, knew what they were doing, and had specific reasons writing the code as such.