4 ms·
Most programmers are not gifted enough to read the docs? Well there's the problem. Also "The most dangerous code in the world" is a bit misleading. I would say
by ianstallings 14y ago
Most programmers are not gifted enough to read the docs? Well there's the problem.
Also "The most dangerous code in the world" is a bit misleading. I would say the code that runs a Predator drone is a little higher in the danger department.
- gmac 14y agoWell, maybe it's 6 of one and half a dozen of the other. But it's certainly thoughtless API design. The parameter sounds boolean (am I going to verify the SSL host or not?), and essentially it is, except that not verifying it for some reason takes two forms, and a true value turns out to specify one of them. Whereas I doubt that the giftedness of the programmer has much to do with their reading the docs. A gifted programmer might assume that the API designer would do the same thing they would, which is to specify this with a boolean argument.
- eru 14y agoOr rename the parameter to CURL_SSL_VERIFICATION_LEVEL.
- tptacek 14y agoNo! Because CURL_SSL_VERIFICATION_LEVEL 0 is the same as CURL_SSL_VERIFICATION_LEVEL 1: meaningless. The problem isn't simply that VERIFY_HOST is documented as a scale from 0-2 that people are mistaking for a boolean by not reading the docs. The problem is that the scale is pointless, because the value it is expressing actually is a boolean: you are either verifying SSL certificates properly or you might as well not verify them at all. There is no real scale to express. The whole option actually documents a misunderstanding of SSL/TLS on the part of curl's author.
- alex_c 14y ago>Most programmers are not gifted enough to read the docs? Well there's the problem. Which one's easier - fixing an API, or fixing most programmers?