4 ms·

If you dig into opensource code it's not that unusual that you'll find code with a comment saying something like "for compatibility with [version of foo that is

by hannob 4y ago

If you dig into opensource code it's not that unusual that you'll find code with a comment saying something like "for compatibility with [version of foo that is 20 years old by now and we stopped supporting 10 years ago]". There are probably a lot of CPU cycles lost to such code.

TazeTSchnitzel 4y ago
I don't know many examples but it's not uncommon in proprietary code either. Sometimes you have to do ugly workarounds for bugs and you don't know when the bugs will be fixed, so you can't trivially prevent it affecting future versions.
cxr 4y ago
Here's my favorite (from GNU tar): /* Parse base-64 output produced only by tar test versions 1.13.6 (1999-08-11) through 1.13.11 (1999-08-23). Support for this will be withdrawn in future releases. */ <http://git.savannah.gnu.org/cgit/tar.git/tree/src/list.c?id=705bb093174004275009510bdaab6e8046ab37f8#n845 http://git.savannah.gnu.org/cgit/tar.git/tree/src/list.c?id=...>
- brynet 4y ago
  One of my favourites, archive filenames containing a colon ':' character cause GNU tar to execute a command, historically rsh (remote shell), but thanks to the Linux alternatives system, is often aliased to ssh. This was added many years ago to support remote tape drives. GNU tar might randomly make network connections, so sanitize your archive names, I guess..
  - jakeogh 4y ago
    I had to check that because it sounds too "execute arb shell scripts on dhcp lease" to still be there... but there it is... decades later and --force-local not the default? It's almost worse that rsh isn't installed on most systems. pledge(2) is the correct model.
- NullPrefix 4y ago
  No no, don't remove that. You might not use the test tar version, but you may still have tarballs produced by that version.
erk__ 4y ago
FreeBSD just recently [0,1] removed support for booting with the FreeBSD 1.x-4.x bootloader. [0]: https://twitter.com/bsdimp/status/1570987021031866369 https://twitter.com/bsdimp/status/1570987021031866369 [1]: https://reviews.freebsd.org/D36550 https://reviews.freebsd.org/D36550
smoldesu 4y ago
This is a problem with all sufficiently advanced software, honestly. The NT and XNU kernels deal with this all the time, with plenty of exploits and UB simply caused by abusing zombie code. Windows didn't even have proper code for interfacing with NVME hardware at full speed until a few months ago (and very few developers have picked up that DirectStorage API). Similarly, there's a lot of idiosyncratic MacOS behavior that gets abused by projects like OpenCore. The main difference is that when someone balks at the open source code, they can fix it. When someone finds a weird bottleneck on commercial software, our only option is to curse the name of whoever wrote it and move on.

by hannob 4y ago

TazeTSchnitzel 4y ago

I don't know many examples but it's not uncommon in proprietary code either. Sometimes you have to do ugly workarounds for bugs and you don't know when the bugs will be fixed, so you can't trivially prevent it affecting future versions.

cxr 4y ago

Here's my favorite (from GNU tar): /* Parse base-64 output produced only by tar test versions 1.13.6 (1999-08-11) through 1.13.11 (1999-08-23). Support for this will be withdrawn in future releases. */ <http://git.savannah.gnu.org/cgit/tar.git/tree/src/list.c?id=705bb093174004275009510bdaab6e8046ab37f8#n845 http://git.savannah.gnu.org/cgit/tar.git/tree/src/list.c?id=...>

brynet 4y ago
One of my favourites, archive filenames containing a colon ':' character cause GNU tar to execute a command, historically rsh (remote shell), but thanks to the Linux alternatives system, is often aliased to ssh. This was added many years ago to support remote tape drives. GNU tar might randomly make network connections, so sanitize your archive names, I guess..
- jakeogh 4y ago
  I had to check that because it sounds too "execute arb shell scripts on dhcp lease" to still be there... but there it is... decades later and --force-local not the default? It's almost worse that rsh isn't installed on most systems. pledge(2) is the correct model.
NullPrefix 4y ago
No no, don't remove that. You might not use the test tar version, but you may still have tarballs produced by that version.

erk__ 4y ago

FreeBSD just recently [0,1] removed support for booting with the FreeBSD 1.x-4.x bootloader. [0]: https://twitter.com/bsdimp/status/1570987021031866369 https://twitter.com/bsdimp/status/1570987021031866369 [1]: https://reviews.freebsd.org/D36550 https://reviews.freebsd.org/D36550

smoldesu 4y ago

This is a problem with all sufficiently advanced software, honestly. The NT and XNU kernels deal with this all the time, with plenty of exploits and UB simply caused by abusing zombie code. Windows didn't even have proper code for interfacing with NVME hardware at full speed until a few months ago (and very few developers have picked up that DirectStorage API). Similarly, there's a lot of idiosyncratic MacOS behavior that gets abused by projects like OpenCore. The main difference is that when someone balks at the open source code, they can fix it. When someone finds a weird bottleneck on commercial software, our only option is to curse the name of whoever wrote it and move on.