3 ms·

The suggestion would more be to choose the correct technology from the start. Something like Scala is 20 years old, has a massive library ecosystem since it int

The suggestion would more be to choose the correct technology from the start. Something like Scala is 20 years old, has a massive library ecosystem since it integrates with Java, and has type inference so it basically feels like a dynamically typed language, except bugs like this can't happen. It's also high performance thanks to the JVM. I don't know what it was like when Gitlab launched in 2014, but I know it was very solid in 2017 when I started using it. Or if that feels too hipster/niche, just use Java. It's not my cup of tea, but it's boring, practical, and the developer pool is infinite.

simonw 3y ago
You understand that's not exactly actionable or helpful advice, right?
- ndriscoll 3y ago
  It's not actionable for Gitlab, but it's actionable for anyone weighing what technologies they should use for future projects. Use one that doesn't open you to this kind of mistake, and ignore people who talk about "productivity" because that's going to be people arguing about their gut feelings anyway, and everyone will say their chosen stack is more productive. Something like Java is going to have the largest hiring pool, the largest ecosystem, and support from every major vendor. I don't particularly like it and think that Scala is pretty much a straight upgrade, but Java's a smart choice.
  - tptacek 3y ago
    You get that the track record of Java and Java frameworks on web vulnerabilities is pretty abysmal, right? There's a whole gigantic RCE bug class (RCE! in the 2020s!) that originates there. My general take is: glass houses, etc. And: everybody is in a glass house.
    - ndriscoll 3y ago
      I'm not sure what you mean with the bug class; Java serialization? If so I think that's been something where common advice is not to use it for 20+ years. Maybe Spring has had issues. Like I said I don't actually like Java and all the annotation stuff. I avoid it, but it's still going to be one of the more robust choices you can make since every major enterprise uses it. Java had log4shell, which was pretty bad, and probably wouldn't have happened if Java had had string macros. It's one of the reasons why Scala is a better language: people use things like compile time macros which prevents those sorts of mistakes. It looks like akka-http for example has only had DoS vulnerabilities (e.g. getting zip bombed) + some niche stuff like request smuggling if you used it to build a reverse proxy or usage of directory listing on Windows. That said, sure, large frameworks all have bugs. But not being able to tell whether you are dealing with a string or an array in your business logic is just silly.
      - tptacek 3y ago
        If you like Java, use Java. Don't worry about people pointing out how gnarly the security track record is; the security track record of every popular thing is gnarly. I'm not here to tell you what framework to use, only that empirically, you're not going to improve your odds significantly by choosing a different mainstream framework.
        ndriscoll 3y ago
        I don't like Java and I don't consider jobs where I'd be doing a nontrivial amount of Java. But the original comment I replied to said this class of bug is hard to avoid, and it's not. Use any statically typed language, and it can't happen. Java's the obvious choice. C# is probably fine too. Same with something like SQL injection or log4shell. These are also preventable using string formatting macros. If `DatabaseConnection.run` takes a `SqlQuery`, not a `String`, and you can only make a `SqlQuery` through a safe API, and your escape hatch is a macro that does query parameterization instead of string substitution, then your users can't get it wrong. This is how Scala libraries actually work and have worked for years. Similarly if you build your logging library to take MDC objects that are built with format macros. These are solved problems.
  - dheera 3y ago
    Almost every technology today is the wrong choice if you look at it from the perspective of 20 years from now. When Facebook was founded there weren't actually many good alternatives to PHP.
kelnos 3y ago
I've written a lot of Scala, and really like the language (well, aside from them not ditching null and exceptions entirely), but years ago I stopped recommending it for new projects, especially in a corporate setting. It's hard to hire experienced Scala developers, and most Java developers I've worked with were either completely uninterested in writing Scala at all, or didn't care to learn the language well enough to actually make use of its better features, and somehow ended up writing Scala that looked like worse Java than the Java they'd usually write.
EasyMark 3y ago
But you could also do it with Java or Go as well and it would be a lot easier to find programmers for it.

simonw 3y ago

You understand that's not exactly actionable or helpful advice, right?

ndriscoll 3y ago
It's not actionable for Gitlab, but it's actionable for anyone weighing what technologies they should use for future projects. Use one that doesn't open you to this kind of mistake, and ignore people who talk about "productivity" because that's going to be people arguing about their gut feelings anyway, and everyone will say their chosen stack is more productive. Something like Java is going to have the largest hiring pool, the largest ecosystem, and support from every major vendor. I don't particularly like it and think that Scala is pretty much a straight upgrade, but Java's a smart choice.
- tptacek 3y ago
  You get that the track record of Java and Java frameworks on web vulnerabilities is pretty abysmal, right? There's a whole gigantic RCE bug class (RCE! in the 2020s!) that originates there. My general take is: glass houses, etc. And: everybody is in a glass house.
  - ndriscoll 3y ago
    I'm not sure what you mean with the bug class; Java serialization? If so I think that's been something where common advice is not to use it for 20+ years. Maybe Spring has had issues. Like I said I don't actually like Java and all the annotation stuff. I avoid it, but it's still going to be one of the more robust choices you can make since every major enterprise uses it. Java had log4shell, which was pretty bad, and probably wouldn't have happened if Java had had string macros. It's one of the reasons why Scala is a better language: people use things like compile time macros which prevents those sorts of mistakes. It looks like akka-http for example has only had DoS vulnerabilities (e.g. getting zip bombed) + some niche stuff like request smuggling if you used it to build a reverse proxy or usage of directory listing on Windows. That said, sure, large frameworks all have bugs. But not being able to tell whether you are dealing with a string or an array in your business logic is just silly.
    - tptacek 3y ago
      If you like Java, use Java. Don't worry about people pointing out how gnarly the security track record is; the security track record of every popular thing is gnarly. I'm not here to tell you what framework to use, only that empirically, you're not going to improve your odds significantly by choosing a different mainstream framework.
      - ndriscoll 3y ago
        I don't like Java and I don't consider jobs where I'd be doing a nontrivial amount of Java. But the original comment I replied to said this class of bug is hard to avoid, and it's not. Use any statically typed language, and it can't happen. Java's the obvious choice. C# is probably fine too. Same with something like SQL injection or log4shell. These are also preventable using string formatting macros. If `DatabaseConnection.run` takes a `SqlQuery`, not a `String`, and you can only make a `SqlQuery` through a safe API, and your escape hatch is a macro that does query parameterization instead of string substitution, then your users can't get it wrong. This is how Scala libraries actually work and have worked for years. Similarly if you build your logging library to take MDC objects that are built with format macros. These are solved problems.
- dheera 3y ago
  Almost every technology today is the wrong choice if you look at it from the perspective of 20 years from now. When Facebook was founded there weren't actually many good alternatives to PHP.

kelnos 3y ago

I've written a lot of Scala, and really like the language (well, aside from them not ditching null and exceptions entirely), but years ago I stopped recommending it for new projects, especially in a corporate setting. It's hard to hire experienced Scala developers, and most Java developers I've worked with were either completely uninterested in writing Scala at all, or didn't care to learn the language well enough to actually make use of its better features, and somehow ended up writing Scala that looked like worse Java than the Java they'd usually write.

EasyMark 3y ago

But you could also do it with Java or Go as well and it would be a lot easier to find programmers for it.