If blocks without curly braces ಠ_ಠ
and goto statements everywhere :S
the gotos actually make sense in this case. unless you'd prefer some insane tree of if/else?
Apple's SSL/TLS bug
11–20 of 295 posts
Re: Apple's SSL/TLS bug
#12Any theories on how this got committed and merged?
Looks like the kind of mistake an automated merge can make.
Re: Apple's SSL/TLS bug
#13If blocks without curly braces ಠ_ಠ
I cringe whenever I hear people advocating that it's okay to avoid braces with single-statement conditionals/loops/etc.
This is a perfect example of just how bad that suggestion is, and just how disastrous it can be. It's totally worth typing a few extra characters here and there to basically avoid these kind of situations completely.
Re: Apple's SSL/TLS bug
#14If blocks without curly braces ಠ_ಠ
I cringe whenever I hear people advocating that it's okay to avoid braces with single-statement conditionals/loops/etc. This is a perfect example of just how bad that suggestion is, and just how disastrous it can be. It's totally worth typing a few extra characters here and there to basically avoid these kind of situations completely.
Exactly this
This also applies to the "JS without ;" crowd.
You may think you're too good to know all the rules of ; or you can just don't think about it, and worry about other things instead, like your code.
Re: Apple's SSL/TLS bug
#15This shows another of the benefits for the community of open sourcing code - because we can see exactly where and what the bug was steps can be taken in other projects to stop it happening there (I think Adam mentioned he was going to check for a test case in Chrome).
If the code was closed all we would have is Apple's release note which just says validation steps were skipped...
Re: Apple's SSL/TLS bug
#16[deleted]
Re: Apple's SSL/TLS bug
#17If blocks without curly braces ಠ_ಠ
I cringe whenever I hear people advocating that it's okay to avoid braces with single-statement conditionals/loops/etc. This is a perfect example of just how bad that suggestion is, and just how disastrous it can be. It's totally worth typing a few extra characters here and there to basically avoid these kind of situations completely.
Yes, precisely. It's a real "cowboy coder" tell if you ask me, it just reeks of "it's ok because I won't screw up". We should distrust ourselves.
Re: Apple's SSL/TLS bug
#18Emerging tools such as gofmt and clang-format are able to automatically re-format your code based on the language rules rather than the human behind the monitor.
Using those tools this specific category of issues should at least be visible in the formating diff.
Interesting. Never thought about it that way before.
Re: Apple's SSL/TLS bug
#19It's interesting watching all the speculation about "was it a backdoor, or just a bug?" Lots of points in favor or against: 1) It's a huge compromise, and "open" to anyone to exploit, which would ultimately get caught and fixed faster. But it's also not targeting anything specific, so there's less of a signature of the attacker. 2) Incredibly simple, and thus a plausible mistake. 3) Hidden in plain sight I'd generall…
My gut says the probability of a random typo executing without raising an error or exception is rather low. The probability of it doing so in a way that well aligns with the interests of nation states, large corporations, and/or criminal enterprise is even lower.
This might explain DROPOUTJEEP particularly considering how much more efficient it is than breaking messages after they are encrypted.
http://mobile.eweek.com/security/nsa-spying-on-apple-iphones...
Re: Apple's SSL/TLS bug
#20If blocks without curly braces ಠ_ಠ
That's what I first thought too.
The only situation where braces can be safely left out is when the single statement is on the same line as the "if".