3 ms·
SQLite is written in a manner/language which only really affords tests, not proof of correctness. (My point was that it might have been written in a language wh
by Quekid5 6y ago
SQLite is written in a manner/language which only really affords tests, not proof of correctness. (My point was that it might have been written in a language where many of these exploits would not have been possible without subverting the hardware it's running on, but I see from the other responses that I may have phrased it a bit too obliquely.)
- laumars 6y agoPart of the reason SQLite is so prolific is because of the language used, not in spite of it. It’s enabled people to run SQLite on a broad range of hardware, device types and called from any language that supports native C calls (which is a massive array of languages). And let’s not forget the truly amazing performance you get from SQLite too. Had SQLite been written in a language that would have made it easier to perform a proof of correctness then it wouldn’t be nearly as widely used and because of that language choice and then it likely wouldn’t have had the resources (financial nor community input) to complete a proof anyway. So would it have actually been any less buggy if it weren’t a C project? Sometimes worse is better and moaning about “what if” is neither constructive nor even warranted when you consider just how well written SQLite already is and how abundant the tests are.
- Quekid5 6y agoOf course it's popularity is due to using C... but that's not what we were talking about, was it? > Sometimes worse is better and moaning about “what if” is neither constructive[...] ... and yet here we are talking about extremely dangerous and possibly far-reaching vulnerabilities in SQLite.