8 ms·
C return code error handling strikes again.
by staticassertion 5y ago
C return code error handling strikes again.
- 0xbadcafebee 5y agoYou mean crappy programmers strike again? This bug would not happen by properly using structs, typedefs, enums, etc to qualify data types and explicitly declare (in a human-readable way anyway) what values to return when. Just using integers as return values with no intermediate abstraction is crazy.
- ketralnis 5y agoSince we aren't all as smart as you, there's genuine value in languages & principles that guide us dummies to naturally avoid these kinds of issues as part of the happy path
- tadbit 5y agoGiven the poor track record of the OpenSSL project, the grand parent's complaint for crappy programming isn't unfounded.
- dylan604 5y agoIsn't the compiler supposed to protect us? /s
- 0xbadcafebee 5y agoI'm not that smart. I don't have a high IQ or anything. I'm not even a professional software engineer. But if I need to use a tool, I learn the right way to use it. I don't expect it to be easy to use. The biggest lie in software is that new software is better than old software. Anyone who's used software for long enough knows this is ridiculous. You introduce some new software which has some new features indented to fix an old flaw. But then it turns out there's new flaws in the new software that become more of an issue than the old flaws. Most tools in the world don't change significantly over time. Instead of changing the tool, people learn how to use the tool to avoid problems. But that doesn't work in a world where nobody learns how to use the tool right, or is constantly picking up new tools and never learning lessons.
- baby 5y ago> This bug would not happen by not using C FTFY
- wepple 5y agoReally not a value-add contribution. A lot of software that has existed forever is written in C by unpaid volunteers; are you planning to rewrite it in rust? Further, snark could be made about how this will have near zero security impact yet there’s a far more serious bug (log4j) which has already had significant cost and follows endless patterns of Java developers embedding logic flow in untrusted data. “Just don’t use Java lol” etc Edit: Hahaha, hey David. Had no idea that was you.
- baby 5y agoWho is this :D mason?
- cnmlsx 5y agoCome on. As 0xbadcafebee hinted at, you can practically write OCaml in C if you wish to. And good luck dealing with timing attacks, secure data deletion and overflow behavior in other languages.
- staticassertion 5y agoFeels harsh to call C programmers "crappy" but ok
- ChrisMarshallNY 5y agoIsn’t Linus a pretty hard-core C programmer? Not sure I’d call him “crappy.” Not to his face, anyway …
- bigiain 5y agoI'm fairly sure he'd have no such reticence to calling you (or me) crappy to our (mailing list) faces...
- ChrisMarshallNY 5y agoThis is true, but I have to admit, he does C (and programming, in general) quite well.
- deleted 5y ago[deleted]