4 ms·
whatever you do, make your examples bulletproof. even if it's not how you would normally write the code and it seems overly cautious, do your audience a favor
by there 16y ago
whatever you do, make your examples bulletproof. even if it's not how you would normally write the code and it seems overly cautious, do your audience a favor and write the example that way anyway.
if there are any buffer overflows, integer overflows, off-by-one's, signedness issues, failure to check return values of everything, use of typically insecure things like sprintf instead of snprintf, all of these problems will just carry over into your readers' code. please do us all a favor and stress the importance of writing secure code from the ground up and not as an afterthought or something only done just before releasing it.
- alnayyir 16y agoI don't think the learner would appreciate the subtleties, and I don't agree that they'll learn anything from it. I can reinforce each lesson/problem you're describing one by one through the exercises, but a new person simply wouldn't know good code if it slapped them in the face. Confer with Learn Python the Hard Way to get a feel for the aesthetic and technique I'm working towards. I don't want to write bulletproof code, I want to teach them how and why to write bulletproof code. I'm not qualified to meet that kind of lofty standard anyway.
- there 16y agoI don't think the learner would appreciate the subtleties, and I don't agree that they'll learn anything from it. I can reinforce each lesson/problem you're describing one by one through the exercises, but a new person simply wouldn't know good code if it slapped them in the face. that is my point: your readers might not understand everything you're doing, so they're just going to copy and paste parts of it into their new projects. if you give them sloppy code to learn from, they're going to copy that sloppiness into their code that makes its way into the real world. there are a lot of things in c that new programmers have to be especially careful about that aren't relevant to python.
- deleted 16y ago[deleted]
- kingofspain 16y agoAgreed. I was littering code with schoolboy mistakes for a couple of years because of this. The complex stuff was great (heh) but some of the absolute basics were braindead because I thought I knew it. I'd been doing that stuff from day one and never had a problem... Until I did.
- BrandonM 16y ago> I don't want to write bulletproof code, I want to teach them how and why to write bulletproof code. This confuses me. How can you teach someone to do something if you won't do it yourself? Reading your statement literally, you are effectively going to say, "This is how and why to write bulletproof code, but I'm not going to." The whole point of LxTHW is to learn by doing. If you're doing it wrong, they're learning it wrong. > I'm not qualified to meet that kind of lofty standard anyway. Then you shouldn't write the book. Honestly. I know you intend to do some good and to be productive, but serving as a teacher and a reference point in an area that you're not qualified in is actually counterproductive. I'm not saying don't write the book. Get qualified first.
- alnayyir 16y agoNobody's qualified to run a company when they do their first startup either.
- BrandonM 16y agoThat's a pretty dishonest analogy. Your first startup will succeed or fail based on its merits. If you write a book for beginners that is inaccurate, those inaccuracies will be spread in spite of their lack of merit.
- fauigerzigerk 16y agoIf you're not qualified to meet that standard then don't write a C book (or learn more before you do). C programs are either bulletproof or they are a hazard.
- jimwise 16y agoOn the bright side, forcing yourself to write bulletproof code for the book may well be the best way to become qualified.
- alnayyir 16y agoOn the dot.
- fauigerzigerk 16y agoIf I understood him correctly he said that he didn't want to try to do that.
- alnayyir 16y agoSort of, I'm not going to try to write perfect code, but I will make myself a better programmer by doing this. Further, the aim is to teach people how and why to write bulletproof code, not to demonstrate bulletproof CString tutorials.
- alnayyir 16y agoThe unwillingness to do for fear of violating some perfect model leads to never making progress at all. No such thing as a perfect program, startup, relationship, or book.
- fauigerzigerk 16y agoI'm not saying you shouldn't write the book because it might not be perfect. I just disagree with your concept for the book. I think readers must see good code even if they don't understand immediately why it is good code. C programs that aren't really good tend to be really bad because they crash or worse. Not being perfect is not the same as going in the wrong direction.
- misham 16y agoI disagree. If I'm learning a new language, I'm too busy worrying about the commas and semi-colons, not whether or not I'm using strcat or strncat. Worrying about overflows, signedness, etc. is something you do once you're more comfortable with the language. It would be nice to provide links to articles and books on why one should use snprintf instead of sprintf or what is integer overflow and how do you deal with it and other topics for writing secure code. However, as a beginner, it will simply not register since I'm more worried about having used a period instead of an arrow to access a struct member. Perhaps, instead of writing a beginner C book, an advanced C book is needed more.
- there 16y agopaging tom ptacek... tom ptacek to the white courtesy phone...
- aaronblohowiak 16y agoZed's idea of LCTHW was not for a beginner book.
- ced 16y agoOn the other hand, not all C code have to be secure. If I'm building a game for the Wii, don't bother me with stack overflows. The same goes for all the simulations out there (C is used about as much as Fortran in research). That's a lot of code.
- alnayyir 16y agoNot going to bother demonstrating perfect tutorial code. All they'll learn from that is to write flawless tutorial code. Might as well put Lance Armstrong on a bicycle in front of a 5 year old and expect them to learn how to ride a bicycle by watching Lance go in a circle.
- anigbrowl 16y agoOr as a compromise, start with simple, easy-to-read examples teaching basic principles. Give them datasets that will cause the program to blow up, and then explore both the causes and solutions to failure. Ideally, work back from the failures and encourage the reader to try out solutions that don't work so as to develop rigorous problem-solving skills. I've always felt that teaching 'don't do that, cause it's bad' sticks rather poorly - unless something that obviously dangerous is involved, making your own mistakes is much more educational than memorizing a set of best practices and never even peeking into those blind alleys or pitfalls. You can do that and have good habits, but you'll have a dogmatic rather than a fundamental grasp of the knowledge, and this will constrict further development.
- alnayyir 16y agoYou've more or less described what I plan to do and why.
- stcredzero 16y agoPresenting insecure source code in a beginner tutorial would actually be a great way of introducing an introductory software security book. Do the exploits on the into security book on the code examples from the beginner programming book.
- gchpaco 16y agoOne of the things that I admire most about W. Richard Stevens's books is that he checked the return value of everything, even printfs. Anal, sure, but that's what you're supposed to do in C and when you write demo code that doesn't, even if you surround it with warnings like "DO NOT DO THIS", beginners will still do it. Better to get the habits in right from the start.
- deleted 16y ago[deleted]