5 ms·

While I'm not the author of anything, I did on one occasion share Russ Cox' articles on regexes with a fellow developer, only for that developer to reply "that

While I'm not the author of anything, I did on one occasion share Russ Cox' articles on regexes with a fellow developer, only for that developer to reply "that guy is making a mountain out of a molehill, just use re2".

jffry 5y ago
For anybody who's lost: Russ Cox is the original author of re2, a fast C++ library implementing regular expressions that are guaranteed to run in linear-time. There's a collection of articles they wrote talking about regexes and various pitfalls: https://swtch.com/~rsc/regexp/ https://swtch.com/~rsc/regexp/
- deathanatos 5y ago
  This is still relevant today, too. The last several JavaScript vulns. that people at my company have had to upgrade around were because of accidentally quadratic regex in JavaScript. One poor library[1] was attempting to match a header whose grammar was a whoppingly complex, 1#token (this is in the HTTP spec's notation: it means 1 or more `token`s, comma separated with optional whitespace around the comma) and hit this, by trying to split the incoming values with, / *, */ I was shocked that this wasn't compiled to a DFA. (I checked, too: my JS exhibited the behavior in the bug report.) This is, I also think, another reason why "simple" text protocols are not really so simple. The grammar above is "trivial", and yet, this is the end result. I don't feel like the library is particularly at fault: I doubt I would have caught this in code review. [1]: https://www.npmjs.com/advisories/1748 https://www.npmjs.com/advisories/1748
phkahler 5y ago
>> "that guy is making a mountain out of a molehill, just use re2" That's an odd thing about the tech world, it's accessible. As you get better in different areas you are actually more and more likely to make contact with important people (big names? people who did important stuff?). This can creep up on you if you're not aware what level you're operating at. It can be a small world.
- noir_lord 5y ago
  Had this happen to me, I was complementing a particular debugger I liked on an IRC channel and some random id said "Thanks, it's a lot of work". I didn't realise the author of that tool was in the channel - kinda neat that we have such a flat open structure at times.
- toddmatthews 5y ago
  yep. i remember asking a question on google groups about some AppEngine query early on a Saturday morning thinking, "this will never be answered". about 15 minutes later Guido van Rossum answered my question.
  - criddell 5y ago
    I read about a similar example this week. Some news orgs filed FOIA requests for Dr. Anthony Fauci's email and I was surprised at how many regular people just emailed him and got a response. Apparently the guy answers about 1000 emails per day.
  - derefr 5y ago
    Also, people who say so-and-so company (usually Google) is hard to contact for support, or that they require expensive support contracts before they'll talk to you, have likely never tried sending email to the appropriate mailing list for the product. It's amazing how often doing this completely bypasses any corporate first-line-support structure in the way, and just puts the email right into the inbox of the line engineers working directly on the product. It's also amazing how quickly those line engineers reply. (It's as if they treat "replying to random messages on the product mailing list" as their highest-priority job. Or maybe it's just that they're technical people, and my questions are usually very nerd-snipe-y, and get them hooked.)
    - 0xEFF 5y ago
      The appropriate mailing list email address is often listed right at the bottom of the blog article too.
    - 5y ago
nostrademons 5y ago
Google interviewing lore is that there once was a candidate who was asked if they were familiar with MapReduce and replied "MapReduce? Is that like Hadoop?" Reportedly, this was also a major factor in Google's strategy shift to open-source a lot of their infrastructure (GRPC, Bazel, TensorFlow, LevelDB, etc.)

jffry 5y ago

For anybody who's lost: Russ Cox is the original author of re2, a fast C++ library implementing regular expressions that are guaranteed to run in linear-time. There's a collection of articles they wrote talking about regexes and various pitfalls: https://swtch.com/~rsc/regexp/ https://swtch.com/~rsc/regexp/

deathanatos 5y ago
This is still relevant today, too. The last several JavaScript vulns. that people at my company have had to upgrade around were because of accidentally quadratic regex in JavaScript. One poor library[1] was attempting to match a header whose grammar was a whoppingly complex, 1#token (this is in the HTTP spec's notation: it means 1 or more `token`s, comma separated with optional whitespace around the comma) and hit this, by trying to split the incoming values with, / *, */ I was shocked that this wasn't compiled to a DFA. (I checked, too: my JS exhibited the behavior in the bug report.) This is, I also think, another reason why "simple" text protocols are not really so simple. The grammar above is "trivial", and yet, this is the end result. I don't feel like the library is particularly at fault: I doubt I would have caught this in code review. [1]: https://www.npmjs.com/advisories/1748 https://www.npmjs.com/advisories/1748

phkahler 5y ago

>> "that guy is making a mountain out of a molehill, just use re2" That's an odd thing about the tech world, it's accessible. As you get better in different areas you are actually more and more likely to make contact with important people (big names? people who did important stuff?). This can creep up on you if you're not aware what level you're operating at. It can be a small world.

noir_lord 5y ago
Had this happen to me, I was complementing a particular debugger I liked on an IRC channel and some random id said "Thanks, it's a lot of work". I didn't realise the author of that tool was in the channel - kinda neat that we have such a flat open structure at times.
toddmatthews 5y ago
yep. i remember asking a question on google groups about some AppEngine query early on a Saturday morning thinking, "this will never be answered". about 15 minutes later Guido van Rossum answered my question.
- criddell 5y ago
  I read about a similar example this week. Some news orgs filed FOIA requests for Dr. Anthony Fauci's email and I was surprised at how many regular people just emailed him and got a response. Apparently the guy answers about 1000 emails per day.
- derefr 5y ago
  Also, people who say so-and-so company (usually Google) is hard to contact for support, or that they require expensive support contracts before they'll talk to you, have likely never tried sending email to the appropriate mailing list for the product. It's amazing how often doing this completely bypasses any corporate first-line-support structure in the way, and just puts the email right into the inbox of the line engineers working directly on the product. It's also amazing how quickly those line engineers reply. (It's as if they treat "replying to random messages on the product mailing list" as their highest-priority job. Or maybe it's just that they're technical people, and my questions are usually very nerd-snipe-y, and get them hooked.)
  - 0xEFF 5y ago
    The appropriate mailing list email address is often listed right at the bottom of the blog article too.
  - 5y ago

nostrademons 5y ago

Google interviewing lore is that there once was a candidate who was asked if they were familiar with MapReduce and replied "MapReduce? Is that like Hadoop?" Reportedly, this was also a major factor in Google's strategy shift to open-source a lot of their infrastructure (GRPC, Bazel, TensorFlow, LevelDB, etc.)