Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Well, this is sort of fudd being spread by the libressl project.

Most old and large codebases will have a mix of coding styles, etc... even at big companies (take a gander at the recently posted Windows 2000 source code for example, or the leaked Half Life 2 codebase, etc).

Does it make testing more difficult with preferred tool X? Maybe... but perhaps tool X isn't the best fit for the codebase? Or perhaps minor changes could be made to make it work well.

In any event... part of being a developer is being able to read and understand a variety of coding styles... since, coding styles have zero effect on the code's purpose/execution.

Not trying to detract... but we should remember the people who complained about the coding styles and difficultly in reading/understanding the codebase were new to the codebase, and the codebase was not in their expected format... which is normal when you sit down to any new codebase. Also... this is a crypto codebase... so there will be an element that is always difficult for an outsider to read and understand.



It's not a complaint about coding styles. It's a complaint about the code's "purpose/execution". Heartbleed, for example!


The OpenSSL developers intentionally breaking malloc/free and making other ridiculous engineering decisions is not 'mix of coding styles', it's literally incompetence.


I would be careful before you throw the "incompetence" word around. Remember this library was written by some of the best cryptographers around, and has been the standard for a very long time -- because, generally, it does it's job very well.

If you actually look into these "ridiculous engineering decisions" you will find very good reasons why they did things the way they did.

With that said, of course it may be able to be done better. All code can be done better. Remember the OpenSSL team was severely underfunded, and severely understaffed. So it's not fair to label them as "incompetent" one bit.

It's very easy to be an armchair quarterback.


I think the key term in your comment is "cryptographer". Not software engineer, but cryptographer. The actual encryption that goes on in openssl is very good, but the engineering which surrounds that cryptography - not so much.


I think given the various side channel attacks, the actually encryption being very good might be overstating it.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: