4 ms·
Imho, it's a scalability issue. Was OpenSSL secure when it was originally written in X lines of code? Very likely. Is it feasible to expect it to be secure no
by ethbro 12y ago
Imho, it's a scalability issue.
Was OpenSSL secure when it was originally written in X lines of code? Very likely.
Is it feasible to expect it to be secure now that it's X^Y lines of code, when a large class of bugs can exist in any line of code? No.
That's what 15 years of an evolving codebase has taught us. Which is reasonable, given that a lot of open source projects came into existence in the mid-90s. Inculcate lesson, design language for next 15 years. Not that radical.
- adamnemecek 12y agoDoes it really matter whether it's a scalability issue though? The bottom line is that the code has bugs, whether it's due to the fact that the codebase is large is somewhat irrelevant.
- ethbro 12y agoBy scalability, I meant more along the lines of, "Is it possible/efficient/reasonable to write large, secure codebases in language X using process Y?" Answer A is "Yes, bugs come from bad development practices or unskilled programmers." Answer B is "No, there are fundamental issues with the language that make it unreasonable to expect a secure product." In other words, are the primary sources of bugs programmers or the ways the language forces them to interface with it?