4 ms·

I wish that there was some widely agreed upon standard for "considered harmful" articles. Like, they have to be serious problems. They can't just be nitpicks or

I wish that there was some widely agreed upon standard for "considered harmful" articles. Like, they have to be serious problems. They can't just be nitpicks or of the "this will mislead the already clueless layman when the press gets wind of it" bent. There are so many vulnerabilities and exploits developed every year. How can it matter very much if a small handful of them are rewarded more substantially and disclosed using a slightly different than normal procedure? Pwn2own considered a wash, if you ask me.

dchest 16y ago
“Considered Harmful” Essays Considered Harmful http://meyerweb.com/eric/comment/chech.html http://meyerweb.com/eric/comment/chech.html
f- 16y ago
The original "considered harmful" article was essentially one big nitpick, so this use is probably quite appropriate.
- kragen 16y ago
  Wiktionary defines "nitpick" as "To correct minutiae or find fault in unimportant details." But "Go To Statement Considered Harmful" (http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.92.4846&rep=rep1&type=pdf http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.92....) is not about minutiae or unimportant details; it is about how to approach the task of writing a computer program that does what you want instead of something else, a task that is at the core of the modern economy.
  - f- 16y ago
    It focuses on the largely insignificant debate over the merits of one syntax structure over another. It's essentially the vi versus emacs of programming.
    - kragen 16y ago
      It sounds like you haven't read it. Please read it before you attempt to comment on it.
- jamesaguilar 16y ago
  There's a difference between a nitpick and a paper that basically defines a new programming paradigm (or delineates the need for it compared to another paradigm).
tptacek 16y ago
There are so many exploits developed every year. How can it matter very much if I disclose mine? Someone else will, I'm sure. They're all running the same JS fuzzer farms, after all. Who cares if Latvian organized crime gangs find it first? Someone good will find it eventually. Or at least reverse it out of the rootkits. The problem isn't simply that the procedure is different. It's that the procedure is clearly, obviously, demonstrably sub-optimal. The Chrome bug-bounty, which Zalewski is surely involved with, runs year-round. The incentive is, you find something, you file it with them ASAP before someone else does. The same is not the case with CanSec's Pwn2Own, where, for no reason other than marketing for ZDI and CanSec, disclosure happens at one precise time during the year.

dchest 16y ago

“Considered Harmful” Essays Considered Harmful http://meyerweb.com/eric/comment/chech.html http://meyerweb.com/eric/comment/chech.html

f- 16y ago

The original "considered harmful" article was essentially one big nitpick, so this use is probably quite appropriate.

kragen 16y ago
Wiktionary defines "nitpick" as "To correct minutiae or find fault in unimportant details." But "Go To Statement Considered Harmful" (http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.92.4846&rep=rep1&type=pdf http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.92....) is not about minutiae or unimportant details; it is about how to approach the task of writing a computer program that does what you want instead of something else, a task that is at the core of the modern economy.
- f- 16y ago
  It focuses on the largely insignificant debate over the merits of one syntax structure over another. It's essentially the vi versus emacs of programming.
  - kragen 16y ago
    It sounds like you haven't read it. Please read it before you attempt to comment on it.
jamesaguilar 16y ago
There's a difference between a nitpick and a paper that basically defines a new programming paradigm (or delineates the need for it compared to another paradigm).

tptacek 16y ago

There are so many exploits developed every year. How can it matter very much if I disclose mine? Someone else will, I'm sure. They're all running the same JS fuzzer farms, after all. Who cares if Latvian organized crime gangs find it first? Someone good will find it eventually. Or at least reverse it out of the rootkits. The problem isn't simply that the procedure is different. It's that the procedure is clearly, obviously, demonstrably sub-optimal. The Chrome bug-bounty, which Zalewski is surely involved with, runs year-round. The incentive is, you find something, you file it with them ASAP before someone else does. The same is not the case with CanSec's Pwn2Own, where, for no reason other than marketing for ZDI and CanSec, disclosure happens at one precise time during the year.