3 ms·

> "When you throw away code and start from scratch, you are throwing away all that knowledge. All those collected bug fixes. Years of programming work." But, s

> "When you throw away code and start from scratch, you are throwing away all that knowledge. All those collected bug fixes. Years of programming work." But, sometimes, that's exactly what you should do. It brings to mind OpenSSL after Heartbleed. I remember reading that the LibreSSL people were ripping out all kinds of stuff (like kludges and workarounds to support OpenVMS), and rightly so. You might call it "knowledge [and] collected bug fixes," but sometimes the crap is just crap.

lou1306 9y ago
> You might call it "knowledge [and] collected bug fixes," but sometimes the crap is just crap. Key word here is "Sometimes". Reviewing code means you get to find out the reason these hacks were written in the first place, and then decide wheter to keep, rework or delete them. Starting from scratch means you get rid of the worthless crap, yes, but you also lose all the valuable crap.
sgift 9y ago
> ripping out all kinds of stuff So, they weren't starting over. They forked, refactored and removed things no longer needed. Completely different thing.
gruturo 9y ago
LibreSSL is a special case which doesn't fit your example. They threw away code and didn't rewrite most of it - because it was supporting useless stuff. Features like heartbeat (see Hearbleed), obsolete and insecure ciphers, tons of crap no one should ever use again but is supposed to be there for FIPS-140 or other compliance requirements which in 2017 do far, far more harm than good.
vacri 9y ago
> It brings to mind OpenSSL after Heartbleed. It's three years later. What general-purpose OS other than OpenBSD is using LibreSSL?
- smitherfield 9y ago
  Not LibreSSL, but Apple replaced OpenSSL with their own library, Common Crypto. https://developer.apple.com/library/content/documentation/Security/Conceptual/cryptoservices/Introduction/Introduction.html https://developer.apple.com/library/content/documentation/Se... https://opensource.apple.com//source/CommonCrypto/CommonCrypto-7/ https://opensource.apple.com//source/CommonCrypto/CommonCryp...

lou1306 9y ago

> You might call it "knowledge [and] collected bug fixes," but sometimes the crap is just crap. Key word here is "Sometimes". Reviewing code means you get to find out the reason these hacks were written in the first place, and then decide wheter to keep, rework or delete them. Starting from scratch means you get rid of the worthless crap, yes, but you also lose all the valuable crap.

sgift 9y ago

> ripping out all kinds of stuff So, they weren't starting over. They forked, refactored and removed things no longer needed. Completely different thing.

gruturo 9y ago

LibreSSL is a special case which doesn't fit your example. They threw away code and didn't rewrite most of it - because it was supporting useless stuff. Features like heartbeat (see Hearbleed), obsolete and insecure ciphers, tons of crap no one should ever use again but is supposed to be there for FIPS-140 or other compliance requirements which in 2017 do far, far more harm than good.

vacri 9y ago

> It brings to mind OpenSSL after Heartbleed. It's three years later. What general-purpose OS other than OpenBSD is using LibreSSL?

smitherfield 9y ago
Not LibreSSL, but Apple replaced OpenSSL with their own library, Common Crypto. https://developer.apple.com/library/content/documentation/Security/Conceptual/cryptoservices/Introduction/Introduction.html https://developer.apple.com/library/content/documentation/Se... https://opensource.apple.com//source/CommonCrypto/CommonCrypto-7/ https://opensource.apple.com//source/CommonCrypto/CommonCryp...