3 ms·
> Presumably in the absence of OSS, companies would write far simpler software than the OSS they presently use. Simpler, but also worse. Part of the beauty of
by yjftsjthsd-h 3y ago
> Presumably in the absence of OSS, companies would write far simpler software than the OSS they presently use.
Simpler, but also worse. Part of the beauty of sharing common code is that you only need to prevent a problem once and then it can be fixed for everyone. If you write it in-house, it's easy to say "oh it's fine, nobody will ever attack this, it'll only be used under boring conditions, we'll never hit those edge cases" which is great right up until the day when it suddenly becomes very painfully untrue.
- cperciva 3y agoSimpler isn't necessarily worse. Having fewer features tends to make software more reliable and secure.
- pornel 3y agoI don't think you can generalize it like that. It really depends whether the complexity is necessary or not, and that's context-dependent. If the implementation is too simple, it may have issues that impact its reliability. For example, code may be using simple linear search instead of fancier data structures/algorithms, and have issues with handling larger inputs or have accidentally-quadratic code paths. Or may updating data files without the complexity of atomic writes or inter-process locking, and corrupt its data if it's unexpectedly killed/restarted. Implementations that are too simple may be less secure, e.g. lack features for precise access controls, or sandboxing. Simple parsers can become a vulnerability (e.g. request smuggling attacks from underestimating complexity of edge cases in HTTP and URLs). Too-simple tools may just push complexity and security risks elsewhere. There's an endless supply of simple templating engines that make it too easy to introduce XSS vulnerabilities.