9 ms·

I'm developing a twitch whenever I see the word "modern" in a software description. It doesn't actually say anything about what you're doing.

stormbrew 10y ago
In this case I would tend to take "modern" to mean "not based on openssl."
haberman 10y ago
I take it to mean "uses current, best practices." For example: - C++: uses C++11 features, avoids non-RAII resources, prefers standard libraries over older, platform-specific libraries, not written as "C with classes." - C: doesn't do weird stuff like bypassing malloc(), avoids undefined behavior. - in general: has a test suite, probably uses continuous testing like Travis, uses modern language features to achieve cleaner & more robust code.
- sdegutis 10y ago
  > C: doesn't do weird stuff like bypassing malloc(), avoids undefined behavior. Can you elaborate?
  - jmspring 10y ago
    It's a bit of a naive comment, because it wholly depends on the libraries you include and what those do. Use any of the debugging libraries that shim in their own alloc routines, you bypass malloc (or at least do a bunch of things that impact what gets malloc'd).
    - haberman 10y ago
      Sure, but those libraries exist for the explicit purpose of giving malloc() special behavior. I'm talking about general-purpose libraries that implement their own malloc(), thereby preventing the use of these malloc()-hooking libraries.
  - dward 10y ago
    From the tcmalloc paper[0]: > Speed is important for a malloc implementation because if malloc is not fast enough, application writers are inclined to write their own custom free lists on top of malloc. This can lead to extra complexity, and more memory usage unless the application writer is very careful to appropriately size the free lists and scavenge idle objects out of the free list. An example of such an optimization is the arena allocator[1][2] employed by protobuf. Custom memory management schemes are not uncommon in performance critical code. 0: http://goog-perftools.sourceforge.net/doc/tcmalloc.html http://goog-perftools.sourceforge.net/doc/tcmalloc.html 1: https://en.m.wikipedia.org/wiki/Region-based_memory_management https://en.m.wikipedia.org/wiki/Region-based_memory_manageme... 2: https://developers.google.com/protocol-buffers/docs/reference/arenas https://developers.google.com/protocol-buffers/docs/referenc...
    - haberman 10y ago
      > An example of such an optimization is the arena allocator[1][2] employed by protobuf. I work on the protobuf team at Google, so I'm aware of this. Two things about that: 1. The underlying blocks for the arena allocator still come from the system allocator. 2. Because the arena allocator inhibits the capabilities of standard malloc-debugging tools like ASAN and Valgrind, the protobuf arena allocator includes special ASAN-aware code to mitigate this: https://github.com/google/protobuf/blob/d64a2d9941c36a7bc2a7959ea10ab8363192ac14/src/google/protobuf/arena.cc#L137 https://github.com/google/protobuf/blob/d64a2d9941c36a7bc2a7... However, that code is ASAN-specific. It won't help other tools like Valgrind. So yes, different allocators are sometimes warranted for specific patterns like arenas. But if all you want is plain malloc()/free(), you should call malloc()/free(). If you're writing a library, letting the user specify their own allocation callback is also great, since it lets the user do whatever custom bookkeeping/pooling/etc. they want to do. But by default just call malloc()/free() (IMHO).
  - bjourne 10y ago
    http://www.tedunangst.com/flak/post/analysis-of-openssl-freelist-reuse http://www.tedunangst.com/flak/post/analysis-of-openssl-free... http://www.tedunangst.com/flak/post/heartbleed-vs-mallocconf http://www.tedunangst.com/flak/post/heartbleed-vs-mallocconf
  - therein 10y ago
    He might be referring to "sbrk" [0] [0] http://linux.die.net/man/2/sbrk http://linux.die.net/man/2/sbrk
sdegutis 10y ago
> The following things are broken, obsolete, badly designed, underspecified, dangerous and/or insane. Rustls does not support [...]
- johncolanduoni 10y ago
  I'd love to see an explanation for not supporting client authentication. Also, completely ruling out discrete-log DH and requiring PFS is not feasible unless you want to rule out a lot of clients and servers, on top of not supporting TLS 1.1.
  - sdegutis 10y ago
    I've never even heard of client authentication until recently. That's probably why.
    - stormbrew 10y ago
      Obscure is not on the list in GP's quote, and afaik client authentication is none of the things in that list. It's actually used a fair bit in uses of TLS that are not the open web.
      - bluejekyll 10y ago
        Yes. I've implemented client-auth with a private CA, specifically to authenticate services to each other. It's a very handy tool when you have disparate networks.
      - spilk 10y ago
        Coming from a US DoD background, TLS client authentication is mandated for nearly everything. Everyone carries keypairs around their neck on their ID card (PIV smartcard with x.509 certificates)
    - johncolanduoni 10y ago
      If you've ever used OpenVPN, you've used TLS client authentication. That seems like a pretty huge hole to purposely put in your feature set. I understand not implementing it yet because it's more work, but I don't get drawing a line in the sand.
caf 10y ago
I find that it often seems to be a synonym for "opinionated".
ctz 10y ago
I'm using 'modern' here in two ways: - in reference to Mozilla's "Modern TLS" profile: https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_com... - as an antonym for the unlimited backwards-compatibility, kitchen-sink-comprehensive approach of (say) OpenSSL or NSS.
rurban 10y ago
It does. There are distinct properties attached to Modernism and Modern. (I'm architect, hence I'm very much attached to these terms. Unlike SW people who didn't grow up with that). First of all, it's the opposite of Post-Modern, to the perl style do it all in myriads of ways, everything is allowed, OpenSSL style. With Modern, only the best API and implementation is allowed. API's are Stanford style well-planned ahead of time, and not adhoc added New-Jersey style. Changes to the API need a rename, not just a major version bump. Hand-waving simplified development models are okay for a post-modern everything is allowed world, whilst modernism aims for long-term goals, making it easier for the user, not the developer. Modernism is based on "Form Follows Function", and not the other way round. Reduce it, abstract it. Functionalism is everything, marketing is less important. And to avoid popular misconceptions, in our current era "Modern" doesn't mean "New" at all. Modern is more old Stanford-style development. Check the Unix Haters handbook e.g. Rust is new, but this choice alone doesn't allow the use of Modern. Rust is better, because of its superior semantics and guarantees, whilst still adhering to the C ABI. It's a library for everybody afterall, and not comparable to the latest ocaml, haskell or lisp TLS library, which only adheres to their ABI and needs wrappers to be useful for projects in other languages.
- vxNsr 10y ago
  You've given a while bunch of definitions for what you interpret modern to mean but none of those are inherent in the word which is what (I think) the op meant when complaining about its over usage. So while I appreciate your attempt to redefine "modern" with all the above I'd rather people just used the more verbose explanation instead of using the meaningless term.
  - sitkack 10y ago
    My personal list of "I'd rather" is pretty large. We should get together and compare notes.
  - barrkel 10y ago
    Nothing is inherent in a word other than what people understand it to mean, and the worlds where 'modern' is a term of jargon are larger overall than computing. It has fairly specific meanings in art, architecture, literature, and music. Grandparent referred to the meaning of the jargon term in architecture. It's not his personal redefinition; it's an interpretation of a widespread understanding of the word mapped analogously to software. Jargon is important. We'd have a hard time communicating if we could never create new words or imbue existing ones with new meanings by analogy. The more verbose explanation is mostly useful for laymen and beginners.
rectang 10y ago
Likewise. "Modern" is a worthless word. In time, the flaws of any "modern" product will become apparent and it will be replaced by something more "modern".

stormbrew 10y ago

In this case I would tend to take "modern" to mean "not based on openssl."

haberman 10y ago

I take it to mean "uses current, best practices." For example: - C++: uses C++11 features, avoids non-RAII resources, prefers standard libraries over older, platform-specific libraries, not written as "C with classes." - C: doesn't do weird stuff like bypassing malloc(), avoids undefined behavior. - in general: has a test suite, probably uses continuous testing like Travis, uses modern language features to achieve cleaner & more robust code.

sdegutis 10y ago
> C: doesn't do weird stuff like bypassing malloc(), avoids undefined behavior. Can you elaborate?
- jmspring 10y ago
  It's a bit of a naive comment, because it wholly depends on the libraries you include and what those do. Use any of the debugging libraries that shim in their own alloc routines, you bypass malloc (or at least do a bunch of things that impact what gets malloc'd).
  - haberman 10y ago
    Sure, but those libraries exist for the explicit purpose of giving malloc() special behavior. I'm talking about general-purpose libraries that implement their own malloc(), thereby preventing the use of these malloc()-hooking libraries.
- dward 10y ago
  From the tcmalloc paper[0]: > Speed is important for a malloc implementation because if malloc is not fast enough, application writers are inclined to write their own custom free lists on top of malloc. This can lead to extra complexity, and more memory usage unless the application writer is very careful to appropriately size the free lists and scavenge idle objects out of the free list. An example of such an optimization is the arena allocator[1][2] employed by protobuf. Custom memory management schemes are not uncommon in performance critical code. 0: http://goog-perftools.sourceforge.net/doc/tcmalloc.html http://goog-perftools.sourceforge.net/doc/tcmalloc.html 1: https://en.m.wikipedia.org/wiki/Region-based_memory_management https://en.m.wikipedia.org/wiki/Region-based_memory_manageme... 2: https://developers.google.com/protocol-buffers/docs/reference/arenas https://developers.google.com/protocol-buffers/docs/referenc...
  - haberman 10y ago
    > An example of such an optimization is the arena allocator[1][2] employed by protobuf. I work on the protobuf team at Google, so I'm aware of this. Two things about that: 1. The underlying blocks for the arena allocator still come from the system allocator. 2. Because the arena allocator inhibits the capabilities of standard malloc-debugging tools like ASAN and Valgrind, the protobuf arena allocator includes special ASAN-aware code to mitigate this: https://github.com/google/protobuf/blob/d64a2d9941c36a7bc2a7959ea10ab8363192ac14/src/google/protobuf/arena.cc#L137 https://github.com/google/protobuf/blob/d64a2d9941c36a7bc2a7... However, that code is ASAN-specific. It won't help other tools like Valgrind. So yes, different allocators are sometimes warranted for specific patterns like arenas. But if all you want is plain malloc()/free(), you should call malloc()/free(). If you're writing a library, letting the user specify their own allocation callback is also great, since it lets the user do whatever custom bookkeeping/pooling/etc. they want to do. But by default just call malloc()/free() (IMHO).
- bjourne 10y ago
  http://www.tedunangst.com/flak/post/analysis-of-openssl-freelist-reuse http://www.tedunangst.com/flak/post/analysis-of-openssl-free... http://www.tedunangst.com/flak/post/heartbleed-vs-mallocconf http://www.tedunangst.com/flak/post/heartbleed-vs-mallocconf
- therein 10y ago
  He might be referring to "sbrk" [0] [0] http://linux.die.net/man/2/sbrk http://linux.die.net/man/2/sbrk

sdegutis 10y ago

> The following things are broken, obsolete, badly designed, underspecified, dangerous and/or insane. Rustls does not support [...]

johncolanduoni 10y ago
I'd love to see an explanation for not supporting client authentication. Also, completely ruling out discrete-log DH and requiring PFS is not feasible unless you want to rule out a lot of clients and servers, on top of not supporting TLS 1.1.
- sdegutis 10y ago
  I've never even heard of client authentication until recently. That's probably why.
  - stormbrew 10y ago
    Obscure is not on the list in GP's quote, and afaik client authentication is none of the things in that list. It's actually used a fair bit in uses of TLS that are not the open web.
    - bluejekyll 10y ago
      Yes. I've implemented client-auth with a private CA, specifically to authenticate services to each other. It's a very handy tool when you have disparate networks.
    - spilk 10y ago
      Coming from a US DoD background, TLS client authentication is mandated for nearly everything. Everyone carries keypairs around their neck on their ID card (PIV smartcard with x.509 certificates)
  - johncolanduoni 10y ago
    If you've ever used OpenVPN, you've used TLS client authentication. That seems like a pretty huge hole to purposely put in your feature set. I understand not implementing it yet because it's more work, but I don't get drawing a line in the sand.

caf 10y ago

I find that it often seems to be a synonym for "opinionated".

ctz 10y ago

I'm using 'modern' here in two ways: - in reference to Mozilla's "Modern TLS" profile: https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_com... - as an antonym for the unlimited backwards-compatibility, kitchen-sink-comprehensive approach of (say) OpenSSL or NSS.

rurban 10y ago

It does. There are distinct properties attached to Modernism and Modern. (I'm architect, hence I'm very much attached to these terms. Unlike SW people who didn't grow up with that). First of all, it's the opposite of Post-Modern, to the perl style do it all in myriads of ways, everything is allowed, OpenSSL style. With Modern, only the best API and implementation is allowed. API's are Stanford style well-planned ahead of time, and not adhoc added New-Jersey style. Changes to the API need a rename, not just a major version bump. Hand-waving simplified development models are okay for a post-modern everything is allowed world, whilst modernism aims for long-term goals, making it easier for the user, not the developer. Modernism is based on "Form Follows Function", and not the other way round. Reduce it, abstract it. Functionalism is everything, marketing is less important. And to avoid popular misconceptions, in our current era "Modern" doesn't mean "New" at all. Modern is more old Stanford-style development. Check the Unix Haters handbook e.g. Rust is new, but this choice alone doesn't allow the use of Modern. Rust is better, because of its superior semantics and guarantees, whilst still adhering to the C ABI. It's a library for everybody afterall, and not comparable to the latest ocaml, haskell or lisp TLS library, which only adheres to their ABI and needs wrappers to be useful for projects in other languages.

vxNsr 10y ago
You've given a while bunch of definitions for what you interpret modern to mean but none of those are inherent in the word which is what (I think) the op meant when complaining about its over usage. So while I appreciate your attempt to redefine "modern" with all the above I'd rather people just used the more verbose explanation instead of using the meaningless term.
- sitkack 10y ago
  My personal list of "I'd rather" is pretty large. We should get together and compare notes.
- barrkel 10y ago
  Nothing is inherent in a word other than what people understand it to mean, and the worlds where 'modern' is a term of jargon are larger overall than computing. It has fairly specific meanings in art, architecture, literature, and music. Grandparent referred to the meaning of the jargon term in architecture. It's not his personal redefinition; it's an interpretation of a widespread understanding of the word mapped analogously to software. Jargon is important. We'd have a hard time communicating if we could never create new words or imbue existing ones with new meanings by analogy. The more verbose explanation is mostly useful for laymen and beginners.

rectang 10y ago

Likewise. "Modern" is a worthless word. In time, the flaws of any "modern" product will become apparent and it will be replaced by something more "modern".