41–50 of 76 posts
On his quote about educational value of UNIX and being so small you can go through it line by line to lean what it does. Can someone recommend a version appropriate for doing this?
https://en.wikipedia.org/wiki/Lions%27_Commentary_on_UNIX_6t...
(That's what the sibling comments are also referring to!)
"You can't trust code that you did not totally create yourself. (Especially code from companies that employ people like me.) No amount of source-level verification or scrutiny will protect you from using untrusted code." -Ken Thompson Reminds me of Theo de Raadt's quote about ESR's "many eyes" argument: "My favorite part of the "many eyes" argument is how few bugs were found by the two eyes of Eric (the originator of…
Yeah... it turns out that most eyes prefer to pay attention to interesting things which are easy to look at, so the distribution of attention is determined more by politics and fashion than necessity. Popular frameworks and projects that look good on a resume get deeply scrutinized and contributed to, while even simple bugs in mission critical software can go unnoticed for decades because the code is ugly and arcane,…
One of my coolest memories of working at Google was that time. He was so down to earth, never bothered to talk up about who he was (even though I knew). I really appreciated that.
Earlier quoted context omitted.
That first one you quoted is pretty incredible. It's hard for me to even imagine writing many thousands of lines of code in ed today.
I have no idea but perhaps in those days (60s & 70s), they wrote code on paper first before feeding it into the computer? If so, then ed was probably tolerable. It's nigh unthinkable these days of course.
After a while of using it, you kind of do get used to the limitations and work in the system, but I can't say how efficient I'd actually be making a non trivial program with just a line editor. For instance, creating and maintaining consistent indentation is just plain awful because you can't use tab and there is no auto spacing (well, in this particular instance. Unix ed and most other line editors wouldn't have this issue). I bet if I had to use it entirely with no visual editor to back me up, I'd end up being much more in tune to catching my mistakes though.
Earlier quoted context omitted.
Line editors aren't so bad, and the Unix ed is pretty awesome. It's easy to list and read through code, and it has powerful search-and-replace. You just have to get used to using search or cursor movement commands for making edits. The programming I've been doing lately has all been in CP/M, using its "ed", which is a very simple line editor, and I still haven't felt the need to write things out beforehand. I think y…
With ed you can do cursor movements? How? I meant to ask people how they use ed and compile an article, so that people would have a better idea of what's possible and what is not with ed. Could we talk about how ed can be used?
Earlier quoted context omitted.
Line editors aren't so bad, and the Unix ed is pretty awesome. It's easy to list and read through code, and it has powerful search-and-replace. You just have to get used to using search or cursor movement commands for making edits. The programming I've been doing lately has all been in CP/M, using its "ed", which is a very simple line editor, and I still haven't felt the need to write things out beforehand. I think y…
With ed you can do cursor movements? How? I meant to ask people how they use ed and compile an article, so that people would have a better idea of what's possible and what is not with ed. Could we talk about how ed can be used?
"Many if not most of the software we use is probably obsolete according to the latest design criteria. Most users could probably care less if the internals of the operating system they use is obsolete. They are rightly more interested in its performance and capabilities at the user level."
From The Tanenbaum-Torvalds Debate[0]
[0]. http://www.oreilly.com/openbook/opensources/book/appa.html
Earlier quoted context omitted.
With ed you can do cursor movements? How? I meant to ask people how they use ed and compile an article, so that people would have a better idea of what's possible and what is not with ed. Could we talk about how ed can be used?
Oops, sorry to mislead you. I was wrong about Unix ed. I knew it had powerful regex and line addressing, I figured it had character addressing/cursor positioning too. CP/M ed has basic search and replace, but most work is done with cursor movements.
When I see devs are talking/fighting for tech trends or programming patterns or frameworks, Ken's quote ( or message you say ) come in my mind always: "Many if not most of the software we use is probably obsolete according to the latest design criteria. Most users could probably care less if the internals of the operating system they use is obsolete. They are rightly more interested in its performance and capabilitie…
Earlier quoted context omitted.
Given enough eyeballs, all bugs are shallow. - Linus Torvalds
Actually, that quote was "formulated" by Eric S Raymond (to whom Theo was referring as "the originator of the statement"), and is only deceptively named "Linux's Law" [1] in "honor" of Linus Torvalds, which is ironic because it actually dishonors him by being invalid. The point that Theo was making is that ESR talks and talks and types and types about many eyeballs looking at code, but when it comes down to actually…
The other thing I noted on a Heartbleed-related thread was that FOSS never produced high-assurance security despite its labor advantage. Proprietary sector, either industry or CompSci teams, beat them about every time.
https://www.schneier.com/blog/archives/2014/04/reverse_heart...
I elaborate more in replies to DB. It comes down to them not caring enough to apply the level of QA necessary. You have to pay people to do that. You also have to find the right people that can do it since even the knowledge of it isn't widespread. They'll know 100 frameworks and such but not the basic activities for assurance past unit/acceptance testing and review. They'll probably have never heard of Ada/SPARK or SPIN when they tell you about Rust. So on and so forth.
Raymond's claim is utter bullshit. If you want best security, you're better off buying a 3rd-party-evaluated product from high-assurance proprietary. If you want good security that's cheap, it's a small number of proprietary and FOSS projects whose stakeholders put time in for thorough review and analysis. The rest is shit waiting to happen or (looks at CVE list) happening all the time.