3 ms·
That makes it unpleasant which does not necessarily mean insecure. In fact, having an unpleasant codebase can be an advantage from a security standpoint. If the
by jart 6y ago
That makes it unpleasant which does not necessarily mean insecure. In fact, having an unpleasant codebase can be an advantage from a security standpoint. If the code is so ugly and complicated that no one wants to add new features, then that means less churn, and less churn means fewer weaknesses. Imagine if the Sudo codebase, which has had over 9,000 changes, had been written that way. I think Donald Knuth got it right with his marvelous tex.web monstrosity that some software should arch towards immutability. https://mirrors.concertpass.com/tex-archive/systems/knuth/dist/tex/tex.web https://mirrors.concertpass.com/tex-archive/systems/knuth/di...
- tyingq 6y agoIt's another surface to inject code, puts "eval" type functionality in the main code, and makes cleaning up after you've been compromised more difficult.