9 ms·
> they had 6 months. You say that like 6 months is automatically a lot of time. "She had 6 months to give birth". Yeah, only it takes 9, so 6 is short. Consid
by maltalex 9y ago
> they had 6 months.
You say that like 6 months is automatically a lot of time. "She had 6 months to give birth". Yeah, only it takes 9, so 6 is short.
Consider the scope and depth of the issue and the fact that they probably couldn't involve too many people on this effort.
- walterbell 9y agoOther operating system maintainers had only days/weeks in Jan 2018.
- deleted 9y ago[deleted]
- loufe 9y agoWe're all throwing darts in the dark here with regards to the resource they gave the problem and its difficulty. I think the real takeaway is just that it could be something other than just stupidity through and through.
- mannykannot 9y agoUnless you can be sure their response solved their problem without introducing others, it's not evidence of sufficient time.
- dmix 9y agoA single person with a fixed 9 month biological timeframe is the analogy you chose to compare 6 months of a billion dollar company's software development time by potentially hundreds of developers (for better or worse) but importantly for an extremely critical class of bugs and therefore that's "just how it is"? Come on, software is hard but when you fix a vulnerability and expose a far far worse one, and had months to plan, execute, and test it, then you are most certainly justified in being criticized. It's not like we're saying the code is shoddy and needs work, which is entirely excusable in a short timeframe. It's that they've left users far worse off in the end then from where they started.
- amluto 9y agoIf MS had allocated 1000 devs to fix this issue quickly, the result would have been an utter disaster.
- justinjlynn 9y agoIf they had allocated 1k devs into n teams to develop different approaches and review and test each other's code and approach. No, the result would've been a better patch and probably not that piece of hot garbage.
- thatfrenchguy 9y agoThere's probably no 1000 good VM engineers out there, in the world.
- dmix 9y agoYet it didn't take 1000 of them to fix it on other OSes. Why are we even debating 1000 devs anyway? That is hardly the point and throwing more and more bodies at a programming problem is hardly ever a solution, nor one I proposed in my original comment. It's ultimately a matter of talent, resources, and proper management. Which is hardly an insurmountable problem for a major tech company which decades of experience solving world-is-ending bugs.
- chris_wot 9y agoI put it down to lack of openness to a wider review than just Microsoft engineers.
- amluto 9y agoAll but a very small number of those teams would have spent quite a while reading manuals, reading code, and learning how the kernel entry code and pagetable handling code worked. Then they'd come up with something, but there would be a severe shortage of reviewers. Not to mention that the whole problem would most likely leak once that many people knew about it.
- walrus01 9y agocorollary adage: nine women cannot gestate and give birth to a baby in one month.
- stagbeetle 9y agoRetort: That's where you're wrong! If we hooked up nine mothers to one single faetus, we could get the job done in 9 months.[0] The same way, if we hooked up our dev teams to a lead that could delegate the work properly, we could pump out a Meltdown patch in around a month and a half. http://www.pnas.org/content/early/2012/08/28/1205282109?sid=72ab4b8c-aa60-4334-a445-a80ba4b9b066 http://www.pnas.org/content/early/2012/08/28/1205282109?sid=...
- vageli 9y ago> Retort: That's where you're wrong! If we hooked up nine mothers to one single faetus, we could get the job done in 9 months.[0] The same way, if we hooked up our dev teams to a lead that could delegate the work properly, we could pump out a Meltdown patch in around a month and a half. > http://www.pnas.org/content/early/2012/08/28/1205282109?sid=.. http://www.pnas.org/content/early/2012/08/28/1205282109?sid=.... Except this whole train of thought falls apart once you consider the difficulty of "hooking up 9 mothers to a single fetus". In the same way you down play the difficulty of coordinating multiple teams for a solution around breaking research. Show me a working solution of the former and I'll accept the corollary.
- DrScump 9y agoSee Brooks' little-known sequel: The Mythical Woman-Month
- friedButter 9y agoBut 9 women can give birth to one baby per month on average
- ptaipale 9y agoNot really for a period longer than 9 months. Of course, you can have even 9 women deliver 9 babies in one month, but none in the following 10-12 months.
- zeth___ 9y agoDid she try having the pregnancy in parallel? Doesn't sound like she was trying at all.
- jahewson 9y agoTwins - double the bandwidth but the latency stays the same.
- johnhenry 9y ago0.22 vs 0.11 bpm is actually a big improvement despite the latency.
- TeMPOraL 9y ago"Never underestimate the bandwidth of a station wagon full of babies hurtling down the highway"?
- efdee 9y agoIt isn't if you need the baby in 6 months.
- LoSboccacc 9y agojust get one from any outsurcing firm then
- johnhenry 9y agoPre-caching.
- chris_wot 9y agoThe Linux kernel developers came up with a decent solution, how can it be that they can do this and the Microsoft developers cannot?
- braderhart 9y agoHave you seen the Windows code base?
- rxhernandez 9y agoIs Windows written the exact same way as Linux? Never underestimate the amount of technical debt that can be holding a team down.
- chris_wot 9y agoIt appears not, if such a bad bug can get through all the way to release.
- Raymonf 9y ago"Linux" had a bug in which you could log into a system by pressing backspace 28 times a few years ago. And by Linux, I meant GRUB[1], and in turn, (many) Linux systems. We're comparing Linux and Windows, an operating system that contains 3.5 million files[2] (of course, not just the kernel in this case). That isn't really fair. Code is as perfect as humans can make it, and it certainly does not help that there's so much to take into account. [1] http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-by... [2] https://arstechnica.com/gadgets/2018/03/building-windows-4-million-commits-10-million-work-items/ https://arstechnica.com/gadgets/2018/03/building-windows-4-m...
- pecg 9y agoThis GRUB bug you are talking about, is not a kernel problem though; on a side note, I'm going to read on the links you provided as I want to see if encrypted root partitions could also be compromised, I suspect no.
- avip 9y agoGreat analogy. As an ex-manager always said: "3 women don't deliver in 3 months". [E I see walrus01 already got that]
- pizza234 9y agoThis is Scott Adam's (Dilbert) hilarious take on it: http://www.dilbert.com/strip/2007-09-03 http://www.dilbert.com/strip/2007-09-03
- rbobby 9y ago> only it takes 9 What if we outsourced the QA to India?
- yorby 9y agothat's a really bad analogy... Note: I think that those devs should be up for death row /s
- rtpg 9y agoSo I agree with the principle that a lot of time is a lot of time. Inversely, though, I'd argue that Meltdown is a relatively small problem! It's strictly around memory usage, cache, and calling patterns. There's not a lot of systems at play, though there's the hard "figure out which order of instructions gets the state machine in a dangerous state" problem. There's a lot less coordination involved than, say, a system call bug that would subtly return the wrong answer half the time and you know that programs sometimes rely on this and others crash because of it. Some things are hard, other things are hard but at least they're basically math, and math has a bit more determinism involved. Imagine if UX design or debugging strategies could always be broken down into state machines!
- mygo 9y agoyou're looking at the problem all wrong, maltalex. Just hire a developer who is already 3 months pregnant.