4 ms·
Are there alternatives that make it easier to think about all the edge cases?
by Zababa 3y ago
Are there alternatives that make it easier to think about all the edge cases?
- michaelt 3y agoKeep using regular expressions, just stop using . and instead, define what is allowed. You're expecting an input to be a UUID? Check it with ^[a-fA-F0-9\-]{30,40}$ and you know you're not getting any apostrophes or script tags or enormous inputs or empty inputs or newlines or lookalike characters or emojis.
- yencabulator 3y agoThe fault is still present in that, you shouldn't just regexp "look for needle in haystack" in a single phase when you're supposed to extract key-value pairs and operate on the author key. What happened here was that the Github employee programming this didn't bother to read the spec and/or think.
- ylk 3y agoI think re-implementing the functionality is the mistake here. A big counter-argument to “rewrite in rust” is usually that by rewriting you introduce new bugs. Especially for security critical things one should re-use the implementation to avoid issues like the above. Proving both the original and re-implemented parser to be equivalent would probably also work, but not sure how practical. And in any case have competent people audit what you did.
- avgcorrection 3y agoHow did we get from criticizing regexes to mocking “rewrite in rust” in the span of three comments?
- ylk 3y agoI’m not mocking it. I’m just applying the argument I see many people on HN make in discussions about rust to this case, where I suspect many will lean much more on the side of using regexes to reimplement parsers. Don’t know if that’ll be the same people. Either way, I didn’t want to have a discussion about rust.
- avgcorrection 3y ago> I’m not mocking it. I’m just applying the argument I see many people on HN make in discussions about rust to this case, where I suspect many will lean much more on the side of using regexes to reimplement parsers. Hmm. Okay. The part that bewilders me is that Rust showed up. Which would have made sense if someone was complaining about C++ or something, or maybe unsafe memory management. But regexes? > Either way, I didn’t want to have a discussion about rust. Which is why you brought it up unprompted... I give up.
- ylk 3y agoOkay, I’ll give you one more thing: I love using rust. I also use zoxide, ripgrep, dua, etc. I don’t hate the language. Quite the opposite. I hope you can now go back and just see the argument for what it is and not for what you thought I was insinuating.
- mistercheph 3y agoHey, watch what you’re saying buddy, ‘rewrite in rust’ is what pays the bills in this family!