4 ms·

In general - no, but this kind of fundamental mistake might.

steveklabnik 4y ago
I hope I never work on software you folks use. The grand claims about something that is not even hard to fix is just wild to me.
- gowld 4y ago
  What about the next 500 easy-to-fix bugs? Is there a public test suite?
  - steveklabnik 4y ago
    > Is there a public test suite? The entire specification (which is admittedly incomplete) and implementation are open source. I am not aware of a dedicated test suite for alternative implementations. It's too early, IMHO. I personally would much prefer the team to focus their time elsewhere for the time being.
    - ShroudedNight 4y ago
      My instincts may be way off-base, but if I was developing a protocol at the core of my product vision, even if there was only one implementation, I would a want an authoritative test suite. I wouldn't trust myself not to integrate load-bearing idiosyncrasies (and bugs, honestly) otherwise.
      - steveklabnik 4y ago
        I mean, I don't think you're incorrect, but I do think that like, semantics matters here. There is a test suite, of their implementation. Just because they have not extracted it and made it easily re-usable for alternative doesn't mean that they don't have checks to ensure regressions don't appear, you know? They already build off of many related specifications, which have independent implementations, and a lot of the core protocol is RPC style, with schemas that they do publish. So there's already a lot of rigidity here for alternative implementations to use in a way that is extremely likely to be compliant. I guess another way of putting it is "I don't exactly disagree with you but doing that takes work, and we're at the stage of this stuff where that work is being done, so expecting it right now feels premature to me." The spec isn't "released" or "done," it's in development.
- seba_dos1 4y ago
  Being easy to fix is completely irrelevant. The thing is that it's easy to avoid. The only way to end up there is to not put any thought into the domain verification scheme before deploying it. Any kind of review would catch it. That's what makes it look really bad.
  - deleted 4y ago
    [deleted]
- account42 4y ago
  If your response to a fundamental design flaw of identy verification is "something that is not even hard to fix" then that hope is mutual.

I hope I never work on software you folks use. The grand claims about something that is not even hard to fix is just wild to me.

gowld 4y ago
What about the next 500 easy-to-fix bugs? Is there a public test suite?
- steveklabnik 4y ago
  > Is there a public test suite? The entire specification (which is admittedly incomplete) and implementation are open source. I am not aware of a dedicated test suite for alternative implementations. It's too early, IMHO. I personally would much prefer the team to focus their time elsewhere for the time being.
  - ShroudedNight 4y ago
    My instincts may be way off-base, but if I was developing a protocol at the core of my product vision, even if there was only one implementation, I would a want an authoritative test suite. I wouldn't trust myself not to integrate load-bearing idiosyncrasies (and bugs, honestly) otherwise.
    - steveklabnik 4y ago
      I mean, I don't think you're incorrect, but I do think that like, semantics matters here. There is a test suite, of their implementation. Just because they have not extracted it and made it easily re-usable for alternative doesn't mean that they don't have checks to ensure regressions don't appear, you know? They already build off of many related specifications, which have independent implementations, and a lot of the core protocol is RPC style, with schemas that they do publish. So there's already a lot of rigidity here for alternative implementations to use in a way that is extremely likely to be compliant. I guess another way of putting it is "I don't exactly disagree with you but doing that takes work, and we're at the stage of this stuff where that work is being done, so expecting it right now feels premature to me." The spec isn't "released" or "done," it's in development.
seba_dos1 4y ago
Being easy to fix is completely irrelevant. The thing is that it's easy to avoid. The only way to end up there is to not put any thought into the domain verification scheme before deploying it. Any kind of review would catch it. That's what makes it look really bad.
- deleted 4y ago
  [deleted]
account42 4y ago
If your response to a fundamental design flaw of identy verification is "something that is not even hard to fix" then that hope is mutual.