4 ms·

I agree, but to be fair, goto fail was not really caused by the lack of curly braces around an if statement body. It was caused by inadequate code review and la

by swift 10y ago

I agree, but to be fair, goto fail was not really caused by the lack of curly braces around an if statement body. It was caused by inadequate code review and lack of testing coverage. The latter especially is inexcusable in security-critical code.

paulddraper 10y ago
"The building's collapse was not caused by poor choices in materials, but by inadequate inspection procedures." Any number of things could have prevented the bug. So lets do all of them.
- taeric 10y ago
  That logic clearly fails, though. You will never do everything to prevent a failure. (As an example, there are almost always stronger materials. Cost is a requirement,) Though, your point here is interesting. Using curlies probably could have stopped that bug. Using static analysis that saw dead code definitely would have stopped it. In this case, mechanisms (automatic checking for dead code) are vastly superior to good intentions (always using curlies).
  - paulddraper 10y ago
    You're right. I didn't mean literally everything. I mean everything that has more benefits than costs. I consider consistent curly brace style to fit in that category.
    - taeric 10y ago
      Consistent is nice. There are place where it is consistent to not use them, though. And to be clear, I find that just as weird as you probably do. :)
- loeg 10y ago
  Out of millions of CVEs, one is plausibly related to this coding style. I don't think that's a strong argument for using the more verbose style. If we saw this all the time it might be a different matter. I think it is a strong argument for compilers' -Wall to detect misindented statements directly following unbracketed conditional expressions, though.
  - chris_wot 10y ago
    Does this make it a moo-t point?
  - paulddraper 10y ago
    Also a strong argument for Python's syntax :)
    - Grue3 10y ago
      Except in Python both the incorrect and correct code are syntactically valid and the error cannot be detected by auto-formatter.

by swift 10y ago

paulddraper 10y ago

"The building's collapse was not caused by poor choices in materials, but by inadequate inspection procedures." Any number of things could have prevented the bug. So lets do all of them.

taeric 10y ago
That logic clearly fails, though. You will never do everything to prevent a failure. (As an example, there are almost always stronger materials. Cost is a requirement,) Though, your point here is interesting. Using curlies probably could have stopped that bug. Using static analysis that saw dead code definitely would have stopped it. In this case, mechanisms (automatic checking for dead code) are vastly superior to good intentions (always using curlies).
- paulddraper 10y ago
  You're right. I didn't mean literally everything. I mean everything that has more benefits than costs. I consider consistent curly brace style to fit in that category.
  - taeric 10y ago
    Consistent is nice. There are place where it is consistent to not use them, though. And to be clear, I find that just as weird as you probably do. :)
loeg 10y ago
Out of millions of CVEs, one is plausibly related to this coding style. I don't think that's a strong argument for using the more verbose style. If we saw this all the time it might be a different matter. I think it is a strong argument for compilers' -Wall to detect misindented statements directly following unbracketed conditional expressions, though.
- chris_wot 10y ago
  Does this make it a moo-t point?
- paulddraper 10y ago
  Also a strong argument for Python's syntax :)
  - Grue3 10y ago
    Except in Python both the incorrect and correct code are syntactically valid and the error cannot be detected by auto-formatter.