The Apple goto fail vulnerability: lessons learned (2014)

Post by int_19h » Wed, Jan 20, 2021, 7:10 PM UTC

jimbob45 wrote: post #8

bobbylarrybobby wrote: post #5

For as long as I live, I’ll never understand style guides that permit omitting brackets around a single line following an if statement (or for, while, etc), nor code formatters that dont automatically insert them.

It can make code bloated and harder to follow. TBH it would be nice if someone made C with indent scoping instead of block scoping but I don’t think that’s truly practical with the preprocessor.

What's the practical difference between:

   if (foo)
      bar;
   else
      baz;

and:

   if (foo) {
      bar;
   } else {
      baz;
   }

The latter has one extra line, which is hardly bloat. It also has the braces, of course, but the upside of this style is that it's clear where the compound statement begins (it's the line that doesn't start with a brace!), and where it continues.

Post by dwheeler » Fri, Jan 22, 2021, 11:48 PM UTC

olliej wrote: post #37

MrXOR wrote: post #21

Earlier quoted context omitted.

Excuse me for changing the title of your essay. I should not do that. The title was just my opinion. Some days ago, I read the excellent newsletter [1] of Filippo Valsorda about a Telegram's bug [2]. Yesterday, I googled for bugdoors and read about them and found this Apple's bug and your excellent essay (with many useful hyperlinks) about it. [1] https://news.ycombinator.com/item?id=25726068 [2] https://habrahabr.ru…

This was obviously a merge error.

I think that's very likely, but I've never seen a post mortum from Apple where they track down what happened.

I wish they would be more open about what happened. Mistakes happen. It's better for the industry if we can all learn from them.

Re: The Apple goto fail vulnerability: lessons learned (2014)

Re: The Apple goto fail vulnerability: lessons learned (2014)