81–86 of 86 posts
Maybe the silver lining here is that it puts the final nail in the coffin for "many eyes make all bugs shallow" - which was always total BS from the day it was uttered. There's so much code out there, much of it highly specialized and even project-specific, that there are very few eyes looking at any particular piece of code, and not all eyes are connected to the greatest of brains. Most static code analyzers could h…
Strangely, nobody's tracking down the nginx developer who inserted the exact same bug into nginx just a few years back (a NUL in a header would cause the header copies, done using strncpy, to abort early and expose uninitialized memory). He must have been an NSA plant too, right?
Earlier quoted context omitted.
The armchair crypto brigade aren't helping much, either, by passing around these completely unfounded accusations of malfeasance. I'm all for being aware of the possibility that shenanigans are involved, but until proof comes out, it is nothing but a possibility, and a remote one at that.
"Never attribute to malice that which is adequately explained by stupidity." Obviously "stupidity" is way too strong here, but the principle still applies.
Strangely, nobody's tracking down the nginx developer who inserted the exact same bug into nginx just a few years back (a NUL in a header would cause the header copies, done using strncpy, to abort early and expose uninitialized memory). He must have been an NSA plant too, right?
Why aren't we doing exactly that? While its best not to attribute to malice what could easily be explained by human stupidity, shouldn't we try to rule out malice?
Seriously, this place is like Lord of the Flies sometimes.
Earlier quoted context omitted.
Part of me wants to see the team give the industry a big middle finger and quit the project, and now companies relying on it have to start spending money to keep it up instead of expecting it to be provided for free. If something is important to you, you should spend more resources than zero on it.
That would be great. Maybe we could get some TDD people in there. Some competent c engineers, rather than code cowboys.
Earlier quoted context omitted.
Why aren't we doing exactly that? While its best not to attribute to malice what could easily be explained by human stupidity, shouldn't we try to rule out malice?
Yes! More witch hunts! That's what I was suggesting! Seriously, this place is like Lord of the Flies sometimes.
now, perhaps you could answer the original question I was asking: shouldn't we rule out malice?