3 ms·

It also means that when a bug is found in that code that you only have to fix it in one place, not 75,000 random places where it's duplicated, and probably slig

It also means that when a bug is found in that code that you only have to fix it in one place, not 75,000 random places where it's duplicated, and probably slightly differently each time, making it hard to search for.

ajross 14y ago
That seems to be belied by this very case, no? Rails had two ways of doing something, one of which forgot where the input could come from...
- __david__ 14y ago
  Hmm... How would copy-pasta code have prevented this?
  - ajross 14y ago
    I fear from your language that you aren't really interested in reasonable argument, but I'll try anyway: ActiveRecord had two variant find() interfaces, one of which tried to make it "easy" on the programmer by avoiding the need to extract an ID to do the lookup. And it went further by adding an overloaded argument syntax that allowed you to elide the first argument entirely. And it forgot that that second argument simultaneously (1) was defined by a remote client and (2) could contain arbitrary SQL. So yes: "copy pasta" of the id boilerplate around an AR find() call would absolutely have prevented this. Rails got slick, and got burned. DRY helped reduce "copy pasta" (sigh) but hurt security.
    - __david__ 14y ago
      Isn't that really the fault of an overloaded (as in doing too much) function API rather than a DRY related problem?
      - ajross 14y ago
        Well, yes, but my point was that I see them as part of the same thing. A function (or whatever) that does lots of related things can be "DRY" if it avoids writing out all the related things longhand, or it can be "too much" if it introduces bugs. DRY as a general philosophy to avoid cut-and-paste code is fine. But it's also an ethic that in my experience prioritizes concision at the expense of clarity. Loss of clarity is a factor in half the security bugs on the internet.

3 ms·

It also means that when a bug is found in that code that you only have to fix it in one place, not 75,000 random places where it's duplicated, and probably slig

by __david__ 14y ago

ajross 14y ago
That seems to be belied by this very case, no? Rails had two ways of doing something, one of which forgot where the input could come from...
- __david__ 14y ago
  Hmm... How would copy-pasta code have prevented this?
  - ajross 14y ago
    I fear from your language that you aren't really interested in reasonable argument, but I'll try anyway: ActiveRecord had two variant find() interfaces, one of which tried to make it "easy" on the programmer by avoiding the need to extract an ID to do the lookup. And it went further by adding an overloaded argument syntax that allowed you to elide the first argument entirely. And it forgot that that second argument simultaneously (1) was defined by a remote client and (2) could contain arbitrary SQL. So yes: "copy pasta" of the id boilerplate around an AR find() call would absolutely have prevented this. Rails got slick, and got burned. DRY helped reduce "copy pasta" (sigh) but hurt security.
    - __david__ 14y ago
      Isn't that really the fault of an overloaded (as in doing too much) function API rather than a DRY related problem?
      - ajross 14y ago
        Well, yes, but my point was that I see them as part of the same thing. A function (or whatever) that does lots of related things can be "DRY" if it avoids writing out all the related things longhand, or it can be "too much" if it introduces bugs. DRY as a general philosophy to avoid cut-and-paste code is fine. But it's also an ethic that in my experience prioritizes concision at the expense of clarity. Loss of clarity is a factor in half the security bugs on the internet.