3 ms·
I think robustness is good. But. There needs to be a way to validate your output against a strict spec. It's too easy to say "these 3 programs can read my outpu
by phkahler 5y ago
I think robustness is good. But. There needs to be a way to validate your output against a strict spec. It's too easy to say "these 3 programs can read my output so it must be ok." That form of testing isnt valid when everyone is being robust. You gotta have a solid way to verify output.
- josefx 5y agoUntil you run into a HTTP/2 to HTTP/1 tunneling setup where your HTTP/2 frontend thinks it forwarded one well defined and safe HTTP/1 message to your backend, but the backend sees an additional malformed HTTP/1 header field that changes the message length and suddenly it sees a second malicious message. The result leaking thousands of user authentication tokens for some widely used web services. If necessary robustness should be part of the spec, not some wild and ill defined outgrowth of implementations that some intern hacked in at the eleventh hour to make things work just before release.