Live data from Hacker News

Introducing Malicious Code Reviews

paulbiggar.blogspot.com

11–15 of 15 posts

Re: Introducing Malicious Code Reviews

#11
I showed this to my roommate, and he mentioned in his product, the lexer is similarly written. The reason for this is, apparently, it is a really simple way of implementing a finite state machine.

Wikipedia mentions the pattern as well:

"The lex/flex family of generators uses a table-driven approach which is much less efficient than the directly coded approach. With the latter approach the generator produces an engine that directly jumps to follow-up states via goto statements. Tools like re2c and Quex have proven (e.g. article about re2c) to produce engines that are between two to three times faster than flex produced engines.[citation needed] It is in general difficult to hand-write analyzers that perform better than engines generated by these latter tools." (http://en.wikipedia.org/wiki/Lexical_analysis)

Re: Introducing Malicious Code Reviews

#12
post #2

The best you can come up with is how tangled the code in a hand-written lexer looks? I may have skimmed a bit towards the end, but, did you actually find a bug?

That code is really bad. Dunno about you, but to me this handcrafted entanglement looks like the crap that any professional programmer should be ashamed of: if ( .. ) { for ( .. ) { label: ... } } else { if ( .. ) { .. } else goto label; .. } The actual code is even worse than this as there's a second goto that jumps from the top for into one of else blocks at the bottom from where the control can go back to for via…

It has been explained that this is just a way of implementing a fast lexical scanner. This is the kind of code that you don't come up with, it is a mechanical implementation of a state machine.

Re: Introducing Malicious Code Reviews

#13
This guy is not doing a fair review. He is just badmouthing the code without providing alternatives. The code doesn't look good, but a constructive review would be much more appreciated by everyone. By acting this way, he is just making a fool of himself.

Re: Introducing Malicious Code Reviews

#14

Earlier quoted context omitted.

That code is really bad. Dunno about you, but to me this handcrafted entanglement looks like the crap that any professional programmer should be ashamed of: if ( .. ) { for ( .. ) { label: ... } } else { if ( .. ) { .. } else goto label; .. } The actual code is even worse than this as there's a second goto that jumps from the top for into one of else blocks at the bottom from where the control can go back to for via…

It has been explained that this is just a way of implementing a fast lexical scanner. This is the kind of code that you don't come up with, it is a mechanical implementation of a state machine.

Mechanical or not, this is a very untidy way of implementing a "fast lexical scanner". Even the Duff's device looks cleaner and more elegant in comparison. And it's not like there is a shortage of other implementation options that are as fast.

Re: Introducing Malicious Code Reviews

#15
post #4

Is the PHP community open to refactorings of the code? Do they have the tests in place to make that possible?

The PHP community is dead. The number of recent innovative libraries/components/technologies implemented in PHP (0) confirms it. The Dead Sea Effect (http://brucefwebster.com/2008/04/11/the-wetware-crisis-the-d...) only made it worse.
Post reply on HN