3 ms·

There are times where I envy the straight forward rationale of these beasts of burden we instruct in our daily routines. The name of the package is irrelevant t

There are times where I envy the straight forward rationale of these beasts of burden we instruct in our daily routines. The name of the package is irrelevant to them, its just an identifier that represents a thing that does stuff. As software engineers you'd hope we were some of the most logical peoples of this planet but then we find ourselves tripping over our own societal taboos and inferences we are perceiving that didn't even exist in the first place. I mean I can understand the odd chuckle over the BackendInspector class but to take something to this level just over the name? I'd be interested to hear the full coverage that this got cause the original author appears to be completely distraught over the reaction: http://fossil.instinctive.eu/libupskirt/wiki?name=about-the-name http://fossil.instinctive.eu/libupskirt/wiki?name=about-the-... Makes me wonder what does more harm. A potentially offensive name or people's reaction to said name. I'm leaning towards the latter based on that link.

tptacek 15y ago
I don't know how upset she really is here (the page you linked to seems pretty measured) but she's had an "us vs. them" narrative going with her library for awhile, ever since Github forked it. I can't find it now, but she had a commit-for-commit commentary for Github's "Redcarpet" fork which at times seemed unhinged. I paid attention to this only because we helped with Github's audit of the code, and am motivated to comment here primarily as an opportunity to say: Make sure your Markdown library is secure. Everyone seems at some point to end up with a C-language Markdown implementation, and nobody I know of has managed to implement Markdown in C without memory corruption bugs... you know, the kind that let attackers upload their own code onto your servers.
- Quarrelsome 15y ago
  Now this is what I'm much more interested in. Security of the code is a off-the-charts more important than what the package happens to be called. ;) Thanks for the insight. The article suggests the author is upset due to controversy due to the name but I assume her anguish is more due to the forking of the library and what she feels is the removal of her credit?
  - tptacek 15y ago
    No; Github gave her credit immediately on starting the project. She was irritated that they chose to fork her code at all, and disapproved of many of the changes. But her code, as Github found it, was absolutely not safe to run on a popular public web app.
    - Quarrelsome 15y ago
      This is so much more of a better story than the OP. Thanks for filling in the gaps, much appreciated.
      - grncdr 15y ago
        Having submitted the OP, I completely agree. You never know where an informative tptacek post will show up... :)

tptacek 15y ago

I don't know how upset she really is here (the page you linked to seems pretty measured) but she's had an "us vs. them" narrative going with her library for awhile, ever since Github forked it. I can't find it now, but she had a commit-for-commit commentary for Github's "Redcarpet" fork which at times seemed unhinged. I paid attention to this only because we helped with Github's audit of the code, and am motivated to comment here primarily as an opportunity to say: Make sure your Markdown library is secure. Everyone seems at some point to end up with a C-language Markdown implementation, and nobody I know of has managed to implement Markdown in C without memory corruption bugs... you know, the kind that let attackers upload their own code onto your servers.

Quarrelsome 15y ago
Now this is what I'm much more interested in. Security of the code is a off-the-charts more important than what the package happens to be called. ;) Thanks for the insight. The article suggests the author is upset due to controversy due to the name but I assume her anguish is more due to the forking of the library and what she feels is the removal of her credit?
- tptacek 15y ago
  No; Github gave her credit immediately on starting the project. She was irritated that they chose to fork her code at all, and disapproved of many of the changes. But her code, as Github found it, was absolutely not safe to run on a popular public web app.
  - Quarrelsome 15y ago
    This is so much more of a better story than the OP. Thanks for filling in the gaps, much appreciated.
    - grncdr 15y ago
      Having submitted the OP, I completely agree. You never know where an informative tptacek post will show up... :)