3 ms·

The trouble is finding balance between simple DIY implementations or cobbling together a house of cards. "Allow CRUD of names" ok, you'll have it next sprint.

The trouble is finding balance between simple DIY implementations or cobbling together a house of cards. "Allow CRUD of names" ok, you'll have it next sprint. "Allow upload of their resumé docs" no problem, two more weeks. "Parse the docx and PDF files users upload and extract the contents and fill our db schema with relevant data". Well shit. The specs to understand either of those formats are gigantic and now I'm forced to cobble together something using more dependencies if you want it done in less than two year's time.

incrudible 6y ago
Is it really that troublesome to strike a balance between implementing something yourself and using a library when the difference is two weeks versus two years? If, for example, a file format is really complex, it has most likely one implementation that almost everyone uses. If there is a problem with it, you will hear about it. Use that. On the other hand, if a file format is really simple or you only need a simple subset of it, rolling your own could avoid you getting 0-dayed when the most popular implementation has a vulnerability.
- ComodoHacker 6y ago
  >you getting 0-dayed when the most popular implementation has a vulnerability vs getting hit when your vulnerable implementation becomes popular. Not an obvious choice indeed.
  - incrudible 6y ago
    > vs getting hit when your vulnerable implementation becomes popular. Which is not going to happen, because there's no point in publishing something that is tailored to your specific purpose.
    - ivanche 6y ago
      This reminds me of one Finnish student publishing some sort of OS kernel in 1991 or so which supported only his PC-compatible machine...
      - incrudible 6y ago
        Of course, who could rule out that a crappy little domain-specific parser turns into a trillion dollar industry? One should let that remote possibility guide the decision making at all times.

incrudible 6y ago

Is it really that troublesome to strike a balance between implementing something yourself and using a library when the difference is two weeks versus two years? If, for example, a file format is really complex, it has most likely one implementation that almost everyone uses. If there is a problem with it, you will hear about it. Use that. On the other hand, if a file format is really simple or you only need a simple subset of it, rolling your own could avoid you getting 0-dayed when the most popular implementation has a vulnerability.

ComodoHacker 6y ago
>you getting 0-dayed when the most popular implementation has a vulnerability vs getting hit when your vulnerable implementation becomes popular. Not an obvious choice indeed.
- incrudible 6y ago
  > vs getting hit when your vulnerable implementation becomes popular. Which is not going to happen, because there's no point in publishing something that is tailored to your specific purpose.
  - ivanche 6y ago
    This reminds me of one Finnish student publishing some sort of OS kernel in 1991 or so which supported only his PC-compatible machine...
    - incrudible 6y ago
      Of course, who could rule out that a crappy little domain-specific parser turns into a trillion dollar industry? One should let that remote possibility guide the decision making at all times.