5 ms·

You don't rewrite the entire codebase overnight, or even in a single release. Instead, rewrite 10% of the code in 1 year, and within 10 years the entire product

You don't rewrite the entire codebase overnight, or even in a single release. Instead, rewrite 10% of the code in 1 year, and within 10 years the entire product will be rewritten.

Arainach 6y ago
You have no idea of the size or complexity of the Office codebase. It's enormous and external developers have taken hard dependencies on every aspect of it, even undocumented behavior. Therr aren't enough Rust experts in the world, much less at Microsoft, to review code changes at that rate. https://devblogs.microsoft.com/oldnewthing/20031224-00/?p=41363 https://devblogs.microsoft.com/oldnewthing/20031224-00/?p=41... - there are probably just as many companies relying on old Office docs as old Windows programs at this point Rewrites are always a bad idea. https://www.joelonsoftware.com/2000/04/06/things-you-should-never-do-part-i/ https://www.joelonsoftware.com/2000/04/06/things-you-should-...
- flowerlad 6y ago
  So leave it to customers to deal with security breaches arising from use of your software, in perpetuity?
  - Arainach 6y ago
    You fix things as they are discovered, continue adding more static analysis to catch new classes of issue, and continue on. You don't rewrite - certainly not in a new language with all new problems. This isn't a startup with 10 developers - there are literally thousands of developers working on Office and all sorts of internal tooling built around the codebase.
    - flowerlad 6y ago
      > You fix things as they are discovered This will keep companies like NSO in business for decades to come. > there are literally thousands of developers working on Office and all sorts of internal tooling built around the codebase That's no excuse for the security hacks this codebase is enabling. They need to stop adding new features for a decade, if that's what it takes, in order to fix the security issues. Think of all the ransomware attacks, identity theft, attacks on journalists, and democracy even, that the security issues in this codebase is enabling, and will continue to enable if business-as-usual is the way forward. The stakes are high, and these tech companies must be made to pay a heavy price for each security breach enabled by their negligence, and then the economics will be in favor of prioritizing security over features.
      - Daho0n 6y ago
        No, what they (we) need is to be held accountable for the software we build, just like engineers are accountable for what they build.

You don't rewrite the entire codebase overnight, or even in a single release. Instead, rewrite 10% of the code in 1 year, and within 10 years the entire product will be rewritten.

Arainach 6y ago

You have no idea of the size or complexity of the Office codebase. It's enormous and external developers have taken hard dependencies on every aspect of it, even undocumented behavior. Therr aren't enough Rust experts in the world, much less at Microsoft, to review code changes at that rate. https://devblogs.microsoft.com/oldnewthing/20031224-00/?p=41363 https://devblogs.microsoft.com/oldnewthing/20031224-00/?p=41... - there are probably just as many companies relying on old Office docs as old Windows programs at this point Rewrites are always a bad idea. https://www.joelonsoftware.com/2000/04/06/things-you-should-never-do-part-i/ https://www.joelonsoftware.com/2000/04/06/things-you-should-...

flowerlad 6y ago
So leave it to customers to deal with security breaches arising from use of your software, in perpetuity?
- Arainach 6y ago
  You fix things as they are discovered, continue adding more static analysis to catch new classes of issue, and continue on. You don't rewrite - certainly not in a new language with all new problems. This isn't a startup with 10 developers - there are literally thousands of developers working on Office and all sorts of internal tooling built around the codebase.
  - flowerlad 6y ago
    > You fix things as they are discovered This will keep companies like NSO in business for decades to come. > there are literally thousands of developers working on Office and all sorts of internal tooling built around the codebase That's no excuse for the security hacks this codebase is enabling. They need to stop adding new features for a decade, if that's what it takes, in order to fix the security issues. Think of all the ransomware attacks, identity theft, attacks on journalists, and democracy even, that the security issues in this codebase is enabling, and will continue to enable if business-as-usual is the way forward. The stakes are high, and these tech companies must be made to pay a heavy price for each security breach enabled by their negligence, and then the economics will be in favor of prioritizing security over features.
    - Daho0n 6y ago
      No, what they (we) need is to be held accountable for the software we build, just like engineers are accountable for what they build.