4 ms·
With that reasoning, do you also go and reimplement standard libraries just to create enough variance so that if one of them has a security flaw then your code
by gerash 4y ago
With that reasoning, do you also go and reimplement standard libraries just to create enough variance so that if one of them has a security flaw then your code might not inherit it?
IMHO, some software (eg. OpenSSL, rendering engines, etc.) need to be heavily scrutinized and trying to keep multiple implementation around for the sake of diversity makes no sense to me.
Of course if a new implementation of say a rendering engine with a radically different approach emerges I'm all for it taking over.
- WorldMaker 4y agoOpenSSL is, I think, another "case in point" example: Heartbleed was an amazingly awful 0-Day that afflicted OpenSSL and I can only imagine how much worse things might have been if Windows didn't use SChannel and FreeBSD (and thus iOS/macOS) didn't use LibreSSL (and if LibreSSL's fork auditing hadn't made a difference in that situation). Even (especially?) highly scrutinized libraries seem to need diversity in implementation to avoid single point of failure problems.