𝙲𝚑𝚊𝚒𝚛𝚖𝚊𝚗 𝙼𝚎𝚘𝚠

  • 0 Posts
  • 8 Comments
Joined 3 years ago
cake
Cake day: August 16th, 2023

help-circle



  • I think the rules written in Clean Code are mostly a response to the kinds of bad code that Martin had to deal with. I think compared to the bad examples he cites his rules are an improvement.

    Ousterhout mostly pricks holes in these rules, based on the bad code he has seen. But he’s not infallible either since he wrote wrong comments on his own code, which is a bit of a self-own.

    I don’t think it’s entirely possible to provide one set of rules that can be universally applied. You need to adjust your code to the problem you’re solving, your audience, your programming language, etc… You’ll always find counterexamples where doing something a little different works better.

    Code should be self-explanatory, but a good informative comment can go a long way. Long methods should probably be broken up, but not always and not beyond the point of usefulness. I’ve seen examples where the UB version read better than the JO version, and vice versa.

    The value for me in these discussions is finding out why people write what they do, and what they prefer to read (and why). That helps me think about how I can best structure my code for readability. But there’s no point in setting rules and becoming dogmatic about them.



  • I do a lot of security work and iOS RCE vulns are typically patched same day with all devices in support getting that security patch at the same time.

    The ones you know about, yes :). We know there are complete firms actively exploiting iOS devices though. With Android the security community can figure out what the flaws are and patch them, with iOS it’s a black box.

    Android, it’s heavily dependant on the device manufacturer etc, no? So many forks of Android plus countless handsets never get an update as they’re out of support.

    Most devices are legally required to get X years of security updates, and most manufacturers do push those out fairly quickly. Maybe not all the same day, sure, but they do go out.

    I do remember a fair few exploits for iOS devices that allowed an attacker to take over a device without any user interaction, and most mentioned they were actively being exploited by malicious (state) actors.

    All I think however is that the price of the exploit doesn’t necessarily correspond with how secure the device actually is, but rather it’s based on the value that that exploit might hold. US entities would probably also offer more than EU entities, whereas for Android it might be the other way around.