4 ms·
Is there any take-away from this rant? I guess I could have dodged heartbleed if I'd written my own TLS library and avoided any software that depended on OpenSS
by ggreer 12y ago
Is there any take-away from this rant? I guess I could have dodged heartbleed if I'd written my own TLS library and avoided any software that depended on OpenSSL. Considering the effort involved, I think I'll take heartbleed and rotate my keys.
Given the number and quality of libraries today, one should spend very little time re-inventing wheels. I say that as someone who has re-invented multiple wheels. I wrote a clone of Ack[1]. I've built distributed data stores instead of using open source solutions like Cassandra. Even in those cases, building that software was harder than I thought it would be. Existing projects have graduated from the school of hard knocks. Time has forced them to solve issues like cross-platform compatibility, documentation, and API stability. They're certainly not perfect, but unless you're a domain expert with a lot of time to spend, you're not going to do better.
We can only re-invent so many wheels in our limited time. If you do the math, a career consists of approximately 1 million lines of code. Almost always, that time is best spent building on top of existing software.
1. https://github.com/ggreer/the_silver_searcher https://github.com/ggreer/the_silver_searcher
- JadeNB 12y ago> I guess I could have dodged heartbleed if I'd written my own TLS library and avoided any software that depended on OpenSSL. Considering the effort involved, I think I'll take heartbleed and rotate my keys. Although I actually agree with the conclusion of this essay (that, to paraphrase, "don't re-invent the wheel" really means "don't re-invent the wheel if you're trying to invent the car"), I thought that this was really the weak point in the posted argument. Sure, if everyone wrote his or her own TLS library, then we wouldn't have Heartbleed—but instead we'd have a litany of tiny bugs leading to everyone getting exploited in his or her own way. Similarly, the advice "don't roll your own cryptography" doesn't mean that there's no room for new cryptographic schemes, just that it's a lot more likely that the bugs that your scheme would include will have been ironed out in an existing one. Taken to extremes, the argument becomes "don't use an existing OS, because then you'll get bitten by any bug in that OS"! P.S. Just to be clear, though I am replying to you, the arguments above (to which I suspect you are sympathetic) are rather addressed to the author of the post.
- papaf 12y agoHang on. I use Silver Searcher but its a reinvention of Ack. Its a better version of Ack that appeared because you reinvented the wheel.