4 ms·

The difference is that if the bug is in the runtime you have to fix one place and everyone downstream gets that. If you solve one such bug in curl, you solved i

by klez 7y ago

The difference is that if the bug is in the runtime you have to fix one place and everyone downstream gets that. If you solve one such bug in curl, you solved it just in curl. EDIT: I thought about it a bit more and realized it cuts both ways. If you have an RCE in a standard library a lot of programs get an RCE for free while it's not patched. So yeah, a bit of a mixed bag.

ppseafield 7y ago
There's also the difference that, in a GC'd language, you don't have both the language authors and the language users both competing to put these kinds of bugs in their software. :)
- tomatocracy 7y ago
  True, but when you want to interface between code written in two different GC'd languages then you can get similar problems if you're not careful. As the number and use of these various next generation languages proliferates, I suspect we might start to see more of that kind of thing appearing over time.
oconnor663 7y ago
I posted a bit more beside this comment, but I think the difference isn't so much updates or code review but rather the design intention of the language. A language like Java or Python or Rust is designed for every operation to produce some defined behavior, and you can't generally trigger RCE unless you call some function like `unsafePerilousDangerZone(heinousRawPtr)`. Those design defaults bubbles up through libraries written in those languages, so that when you use other people's code and make a mistake, the result is either a crash or an unfortunate-but-at-least-well-defined logic bug. The opposite is true in C and C++, and that bubbles up through the libraries in those languages too.
CaptainMarvel 7y ago
[[Off-Topic - Sorry!]] Hi Klez, I determined this to be the only way to get in touch regarding a previous discussion we had on Blendle [0] as I can no longer reply on that thread. This was back in 2017 so they may have fixed their issues. Alexander Klöpping <alexander.klopping@blendle.com> emailed me, I'll grant it was a generic welcome email, asking for feedback. I took the opportunity to email back informing him of the problems with using my email address [1]. I don't recall the problem now, but it seems they accepted my email address but then later rejected it during the sign-up process (as I clearly received an email correctly...). I no longer have their response, but from memory, it was a different customer service person, and they rejected the idea that they had any problem AND/OR explicitly said they weren't going to make any changes. Oh, and they sent that response to the email that I explicitly said wouldn't work (it automatically gets sent to the trash to be deleted which is also why I don't have it any more). Their rejection of fixing their service is what made me decide to put Blendle in the trash category. [0]: https://news.ycombinator.com/item?id=20138213 https://news.ycombinator.com/item?id=20138213 [1]: My email, sent from X+Y@gmail.com Dear Alexander Klöpping, When I first heard about Blendle I was excited at the concept of being able to read high-quality journalism from multiple different sources through one - ad-free - platform and one reasonably-priced payment system, and so I signed up for the beta. I successfully started the process of joining Blendle by unlocking and selecting some preferences. However, I have been unable to proceed past entering my email address, X+Y@gmail.com. I should make it clear that the email address X@gmail.com cannot be used. Could you please assist me and help me get started with Blendle? Best, [redacted]
- klez 7y ago
  Hey, thanks for replying to that question :) I guess I should give some way to contact me in my profile for cases like this.

by klez 7y ago

ppseafield 7y ago

There's also the difference that, in a GC'd language, you don't have both the language authors and the language users both competing to put these kinds of bugs in their software. :)

tomatocracy 7y ago
True, but when you want to interface between code written in two different GC'd languages then you can get similar problems if you're not careful. As the number and use of these various next generation languages proliferates, I suspect we might start to see more of that kind of thing appearing over time.

oconnor663 7y ago

I posted a bit more beside this comment, but I think the difference isn't so much updates or code review but rather the design intention of the language. A language like Java or Python or Rust is designed for every operation to produce some defined behavior, and you can't generally trigger RCE unless you call some function like `unsafePerilousDangerZone(heinousRawPtr)`. Those design defaults bubbles up through libraries written in those languages, so that when you use other people's code and make a mistake, the result is either a crash or an unfortunate-but-at-least-well-defined logic bug. The opposite is true in C and C++, and that bubbles up through the libraries in those languages too.

CaptainMarvel 7y ago

[[Off-Topic - Sorry!]] Hi Klez, I determined this to be the only way to get in touch regarding a previous discussion we had on Blendle [0] as I can no longer reply on that thread. This was back in 2017 so they may have fixed their issues. Alexander Klöpping <alexander.klopping@blendle.com> emailed me, I'll grant it was a generic welcome email, asking for feedback. I took the opportunity to email back informing him of the problems with using my email address [1]. I don't recall the problem now, but it seems they accepted my email address but then later rejected it during the sign-up process (as I clearly received an email correctly...). I no longer have their response, but from memory, it was a different customer service person, and they rejected the idea that they had any problem AND/OR explicitly said they weren't going to make any changes. Oh, and they sent that response to the email that I explicitly said wouldn't work (it automatically gets sent to the trash to be deleted which is also why I don't have it any more). Their rejection of fixing their service is what made me decide to put Blendle in the trash category. [0]: https://news.ycombinator.com/item?id=20138213 https://news.ycombinator.com/item?id=20138213 [1]: My email, sent from X+Y@gmail.com Dear Alexander Klöpping, When I first heard about Blendle I was excited at the concept of being able to read high-quality journalism from multiple different sources through one - ad-free - platform and one reasonably-priced payment system, and so I signed up for the beta. I successfully started the process of joining Blendle by unlocking and selecting some preferences. However, I have been unable to proceed past entering my email address, X+Y@gmail.com. I should make it clear that the email address X@gmail.com cannot be used. Could you please assist me and help me get started with Blendle? Best, [redacted]

klez 7y ago
Hey, thanks for replying to that question :) I guess I should give some way to contact me in my profile for cases like this.