4 ms·

> "Premature optimization" is a dangerous concept. It tends to imply you can defer all consideration of performance At a deeper level, the problem here is car

> "Premature optimization" is a dangerous concept. It tends to imply you can defer all consideration of performance At a deeper level, the problem here is cargo culting of rules or heuristics. Another example is the proscription of "security through obscurity". It's perfectly valid as a component of a larger, more comprehensive security strategy. But you're gonna get hurt if it's the only component.

cargocult_coder 10y ago
Yes I concur.
dwaltrip 10y ago
Regarding your broader point, I think this immensely important and a very powerful framing to use in many different pursuits. I'd describe it as always striving to acquire and refine the deepest cores of conceptual understanding that can be accurately and meaningfully applied in the widest set of scenarios. And then for two equally useful mental models, prefer the more concise and accessible one. Kind of like the concept of "parsimony" as used in the physical sciences. In software, one begins to see where "best practices" come from and how they can be valuable, but also where such heuristics break down. Getting philosophical, I believe this is a lifelong search -- we will never reach full understanding. Perfect truth is irreducible, so the best we can hope for is an strong approximation.
sqldba 10y ago
You'd be surprised (or maybe not) on the number of experts who fight out about security through obscurity these days - because it's cool to do so. One particular example is using non-standard database ports. I have to fight all the time. "It's pointless. You make it harder for users (well, not really, the one-time setup of an application maybe), and it's not any more secure because it can be port scanned." Personally I disagree because I think port scans are the kind of thing you should, you know, pick up through other software. Their response to this is that nobody tracks internal port scanning, and that it's always external. I give up by that point. Because you can't complain about insider threats but then decide not to bother looking at anything internal.

cargocult_coder 10y ago

Yes I concur.

dwaltrip 10y ago

Regarding your broader point, I think this immensely important and a very powerful framing to use in many different pursuits. I'd describe it as always striving to acquire and refine the deepest cores of conceptual understanding that can be accurately and meaningfully applied in the widest set of scenarios. And then for two equally useful mental models, prefer the more concise and accessible one. Kind of like the concept of "parsimony" as used in the physical sciences. In software, one begins to see where "best practices" come from and how they can be valuable, but also where such heuristics break down. Getting philosophical, I believe this is a lifelong search -- we will never reach full understanding. Perfect truth is irreducible, so the best we can hope for is an strong approximation.

sqldba 10y ago

You'd be surprised (or maybe not) on the number of experts who fight out about security through obscurity these days - because it's cool to do so. One particular example is using non-standard database ports. I have to fight all the time. "It's pointless. You make it harder for users (well, not really, the one-time setup of an application maybe), and it's not any more secure because it can be port scanned." Personally I disagree because I think port scans are the kind of thing you should, you know, pick up through other software. Their response to this is that nobody tracks internal port scanning, and that it's always external. I give up by that point. Because you can't complain about insider threats but then decide not to bother looking at anything internal.