4 ms·

It still blows my mind that so many devices depend on a library largely written by a single person. The level of pressure must be insane and it shows in this b

It still blows my mind that so many devices depend on a library largely written by a single person. The level of pressure must be insane and it shows in this bit: "Reading the code now it is impossible not to see the bug. Yes, it truly aches having to accept the fact that I did this mistake without noticing and that the flaw then remained undiscovered in code for 1315 days. I apologize. I am but a human." If Daniel happens to read this, thanks for your hard work, and I really don't think any apology is necessary. After all, the source was right there for any of us to read and review.

nine_k 3y ago
https://xkcd.com/2347/ https://xkcd.com/2347/ had been true for many years before, and has been true for many years since it was published. Sometimes the "Don't fix it if it ain't broken" principle is interpreted as "don't support it until breaks", and leads to nasty surprises.
- cushpush 3y ago
  In my heart I know this xkcd is a curl reference.
  - nine_k 3y ago
    Including but not limited to, sadly.
avgcorrection 3y ago
I think he'll be fine.
BTinfinity 3y ago
Reminds me of how for a while OpenSSL was being developed and maintained by just two guys called Steve [0]. I think they've upgraded to a team of seven now at least [0] https://www.buzzfeed.com/chrisstokelwalker/the-internet-is-being-protected-by-two-guys-named-st https://www.buzzfeed.com/chrisstokelwalker/the-internet-is-b...
- slowwriter 3y ago
  Presumably all called Steve.
  - estebank 3y ago
    They spiced it up, now there's a Stephan and an Esteban in the mix.
  - trillic 3y ago
    The Steven Seven believe in an uneven heaven.
- jakefromstatecs 3y ago
  A team of Steven
avg_dev 3y ago
i really feel that the first sentence in that quote is an apt way to sum up a part of how learning and attention work for us as humans. personally i've spent some time thinking about how in my life it is very easy for me to pay attention as hard as i can manage and still miss so many things. i feel like things like code review are a great way to work on this sort of thing (attention training, global and contextual awareness, etc.). for example, there is this place that i've been walking by regularly for a couple of years and someone maintains a nice flowerbed there and i pause to take a glance at it and have been doing so for about a year since i first noticed it. but a couple months ago i noticed that there is a companion flowerbed a few feet away that i just had never noticed because i was so focused on the first one. was that companion flowerbed there all along? i suspect that it was! but i have no idea because i didn't even know it existed. i have tried to extrapolate this to knowledge across humanity in general. i suspect sometimes it takes just one person to notice something, to make an observation that informs their behavior, and it begins to disseminate to us all. sometimes it takes several tries and a long time to happen. and i wonder how much low-hanging fruit there is out there that just none of us have noticed yet. and i think about how integrating a simple, fundamental set of best practices already established by others who have been paying attention can improve the low-bar for us all. i think that julia evans touched on this in https://jvns.ca/blog/2023/10/06/new-talk--making-hard-things-easy/ https://jvns.ca/blog/2023/10/06/new-talk--making-hard-things... which was discussed here recently and so did dan luu in his https://danluu.com/p95-skill/ https://danluu.com/p95-skill/ which has also been discussed here somewhere. and, to conclude, i too have a lot of gratitude for stenberg and all the folks who've worked on curl, and many other parts of our internet infrastructure that i usually take for granted every day.
w23j 3y ago
So true. Also becomes apparent from this sentence in the Hackerone report: "This report seems entirely correct and it hurts in my soul." and the blog: "[...] shipping a heap overflow in code installed in over twenty billion instances is not an experience I would recommend." Harsh to have to bear that responsibility for so little reward.
protomolecule 3y ago
[flagged]
- callalex 3y ago
  Did you forget to add a link?
  - avgcorrection 3y ago
    It's at the end of the article.
anuraaga 3y ago
I have found the single-dev projects to _always_ have a wonderful contributor experience, with company or vendor ones often being quite poor. Really can see the passion when they put in the effort to work together on improving the project. While there are likely sustainability issues, I guess we will still continue to have these projects and hats off to everyone like Daniel working not just for themselves but also for their community.

nine_k 3y ago

https://xkcd.com/2347/ https://xkcd.com/2347/ had been true for many years before, and has been true for many years since it was published. Sometimes the "Don't fix it if it ain't broken" principle is interpreted as "don't support it until breaks", and leads to nasty surprises.

cushpush 3y ago
In my heart I know this xkcd is a curl reference.
- nine_k 3y ago
  Including but not limited to, sadly.

avgcorrection 3y ago

I think he'll be fine.

BTinfinity 3y ago

Reminds me of how for a while OpenSSL was being developed and maintained by just two guys called Steve [0]. I think they've upgraded to a team of seven now at least [0] https://www.buzzfeed.com/chrisstokelwalker/the-internet-is-being-protected-by-two-guys-named-st https://www.buzzfeed.com/chrisstokelwalker/the-internet-is-b...

slowwriter 3y ago
Presumably all called Steve.
- estebank 3y ago
  They spiced it up, now there's a Stephan and an Esteban in the mix.
- trillic 3y ago
  The Steven Seven believe in an uneven heaven.
jakefromstatecs 3y ago
A team of Steven

avg_dev 3y ago

i really feel that the first sentence in that quote is an apt way to sum up a part of how learning and attention work for us as humans. personally i've spent some time thinking about how in my life it is very easy for me to pay attention as hard as i can manage and still miss so many things. i feel like things like code review are a great way to work on this sort of thing (attention training, global and contextual awareness, etc.). for example, there is this place that i've been walking by regularly for a couple of years and someone maintains a nice flowerbed there and i pause to take a glance at it and have been doing so for about a year since i first noticed it. but a couple months ago i noticed that there is a companion flowerbed a few feet away that i just had never noticed because i was so focused on the first one. was that companion flowerbed there all along? i suspect that it was! but i have no idea because i didn't even know it existed. i have tried to extrapolate this to knowledge across humanity in general. i suspect sometimes it takes just one person to notice something, to make an observation that informs their behavior, and it begins to disseminate to us all. sometimes it takes several tries and a long time to happen. and i wonder how much low-hanging fruit there is out there that just none of us have noticed yet. and i think about how integrating a simple, fundamental set of best practices already established by others who have been paying attention can improve the low-bar for us all. i think that julia evans touched on this in https://jvns.ca/blog/2023/10/06/new-talk--making-hard-things-easy/ https://jvns.ca/blog/2023/10/06/new-talk--making-hard-things... which was discussed here recently and so did dan luu in his https://danluu.com/p95-skill/ https://danluu.com/p95-skill/ which has also been discussed here somewhere. and, to conclude, i too have a lot of gratitude for stenberg and all the folks who've worked on curl, and many other parts of our internet infrastructure that i usually take for granted every day.

w23j 3y ago

So true. Also becomes apparent from this sentence in the Hackerone report: "This report seems entirely correct and it hurts in my soul." and the blog: "[...] shipping a heap overflow in code installed in over twenty billion instances is not an experience I would recommend." Harsh to have to bear that responsibility for so little reward.

protomolecule 3y ago

[flagged]

callalex 3y ago
Did you forget to add a link?
- avgcorrection 3y ago
  It's at the end of the article.

anuraaga 3y ago

I have found the single-dev projects to _always_ have a wonderful contributor experience, with company or vendor ones often being quite poor. Really can see the passion when they put in the effort to work together on improving the project. While there are likely sustainability issues, I guess we will still continue to have these projects and hats off to everyone like Daniel working not just for themselves but also for their community.