3 ms·

Naive people find liberation in text-based protocols that don't require tools to understand. As a huge fan of text-based protocols (but not of JSON or YAML), c

Naive people find liberation in text-based protocols that don't require tools to understand. As a huge fan of text-based protocols (but not of JSON or YAML), calling a whole class of debuggability, interoperability, and onboarding benefits "naive" is a bit much.

PaulHoule 6y ago
It's a lot of the reason why software has gotten to be so porous in terms of security flaws. I would trust programmers at Intel to handle FORTRAN-style data structures, and maybe even make a compiler in C. I wouldn't trust anybody from Intel to write a web server or even a web application with PHP in that wild west of applications programming with strings they are sure to mess it up and thus leave a vulnerability in the management engine on your CPU. It might superficially look like good code, but American Fuzzy Lop will find the branch that isn't obvious, and so will some kid.
- nicoburns 6y ago
  To me the problem seems to be old-school C programmers thinking that they don't need to use a library to parse a standard format. I have only ever seen JSON parsing errors in C and C++ codebases because they are the only languages where developers seem to think it's a good idea to parse JSON using string functions rather than a JSON parser.
  - PaulHoule 6y ago
    Some of that is that they don't have systems like maven or npm that would make it really easy to incorporate libraries into the build. That said, what I like about C is that it is a simple language where you can throw out the standard library and start anew: it makes me think of the old versions of ALGOL that didn't specify mechanisms for I/O, and now we know you can specify that behavior in libraries and leave the language pure.
    - nicoburns 6y ago
      > Some of that is that they don't have systems like maven or npm that would make it really easy to incorporate libraries into the build. Definitely! I wish the C and C++ communities would take this problem seriously. > That said, what I like about C is that it is a simple language where you can throw out the standard library and start anew This definitely is a nice property. But it's not just C that can do this. You can for example do this with Rust, and get an excellent package management system (that can indeed package these alternatives to the stdlib) to boot.
  - Cloudef 6y ago
    As a C programmer, i can say that most of the json libraries fail on simple fuzzing test, or do some other idiotic stuff like trying to handle numbers (and doing it wrong of course). We have awesome parser generators such as ragel, yet people still handroll parsing code that is both buggy and slow.
    - nicoburns 6y ago
      > We have awesome parser generators such as ragel, yet people still handroll parsing code that is both buggy and slow. Wasn't ragel responsible for the cloudbleed vulnerability? Wherever possible we really shouldn't be using C at all.
      - Cloudef 6y ago
        No, the bug was in code that was feeding input to ragel [1]. Ragel itself was fine. (Ragel also can output to non C languages). I've used ragel myself extensively and it's really rock solid, I've fuzzed the state machines it generates a lot. I've even used it to parse protobuf specifications and generate code from them, the company still uses that code. (and it's really not a lot of code) 1: https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/#comment-3172484963 https://blog.cloudflare.com/incident-report-on-memory-leak-c... (As for cloudflare, I don't think it's good idea to let single company to MITM the whole internet)
        nicoburns 6y ago
        It sounds like Ragel still requires the user to "use it correctly", which is really not great.
        Cloudef 6y ago
        That's like saying driving car into a wall full speed should not kill you
        6y ago
  - perl4ever 6y ago
    I used to be the only one where I worked who would use the standard library for xml in perl rather than just ad hoc regexes. They'd recycle my scripts when dealing with very large files but wouldn't learn it themselves.

PaulHoule 6y ago

It's a lot of the reason why software has gotten to be so porous in terms of security flaws. I would trust programmers at Intel to handle FORTRAN-style data structures, and maybe even make a compiler in C. I wouldn't trust anybody from Intel to write a web server or even a web application with PHP in that wild west of applications programming with strings they are sure to mess it up and thus leave a vulnerability in the management engine on your CPU. It might superficially look like good code, but American Fuzzy Lop will find the branch that isn't obvious, and so will some kid.

nicoburns 6y ago
To me the problem seems to be old-school C programmers thinking that they don't need to use a library to parse a standard format. I have only ever seen JSON parsing errors in C and C++ codebases because they are the only languages where developers seem to think it's a good idea to parse JSON using string functions rather than a JSON parser.
- PaulHoule 6y ago
  Some of that is that they don't have systems like maven or npm that would make it really easy to incorporate libraries into the build. That said, what I like about C is that it is a simple language where you can throw out the standard library and start anew: it makes me think of the old versions of ALGOL that didn't specify mechanisms for I/O, and now we know you can specify that behavior in libraries and leave the language pure.
  - nicoburns 6y ago
    > Some of that is that they don't have systems like maven or npm that would make it really easy to incorporate libraries into the build. Definitely! I wish the C and C++ communities would take this problem seriously. > That said, what I like about C is that it is a simple language where you can throw out the standard library and start anew This definitely is a nice property. But it's not just C that can do this. You can for example do this with Rust, and get an excellent package management system (that can indeed package these alternatives to the stdlib) to boot.
- Cloudef 6y ago
  As a C programmer, i can say that most of the json libraries fail on simple fuzzing test, or do some other idiotic stuff like trying to handle numbers (and doing it wrong of course). We have awesome parser generators such as ragel, yet people still handroll parsing code that is both buggy and slow.
  - nicoburns 6y ago
    > We have awesome parser generators such as ragel, yet people still handroll parsing code that is both buggy and slow. Wasn't ragel responsible for the cloudbleed vulnerability? Wherever possible we really shouldn't be using C at all.
    - Cloudef 6y ago
      No, the bug was in code that was feeding input to ragel [1]. Ragel itself was fine. (Ragel also can output to non C languages). I've used ragel myself extensively and it's really rock solid, I've fuzzed the state machines it generates a lot. I've even used it to parse protobuf specifications and generate code from them, the company still uses that code. (and it's really not a lot of code) 1: https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/#comment-3172484963 https://blog.cloudflare.com/incident-report-on-memory-leak-c... (As for cloudflare, I don't think it's good idea to let single company to MITM the whole internet)
      - nicoburns 6y ago
        It sounds like Ragel still requires the user to "use it correctly", which is really not great.
        Cloudef 6y ago
        That's like saying driving car into a wall full speed should not kill you
        6y ago
- perl4ever 6y ago
  I used to be the only one where I worked who would use the standard library for xml in perl rather than just ad hoc regexes. They'd recycle my scripts when dealing with very large files but wouldn't learn it themselves.