Bill Stewart
Posts: 1
Nickname: billstewar
Registered: Jun, 2003
|
|
Re: Programming Defensively
|
Posted: Jun 13, 2003 6:18 PM
|
|
It's nice to see _somebody_ who still cares about this. So many of the Internet worms and root exploits and similar security disasters we've been seeing are because programmers are blindly trusting input from the outside world without doing some kind of sanity-checking first. Yet that's just about the first lesson I got taught in CS100 in college, along with "Always comment the code so it's readable" and "Here's how to make the PL/I equivalent of HelloWorld compile and run." Our programs had to do something appropriate when given invalid input, and our instructors were quite malicious about designing input to exercise off-by-one bugs and buffer overflows and bogus-values and such. By contrast, the PL/C compiler/runtime also tried to detect overflows, out-of-range numbers, divide-by-zero, etc. and do something to allow the program to continue running with incorrect data, so that debugging runs could find as many bugs as possible per batch punch-card run.
<p>
As far as wood-working goes, I once helped build a church, on a construction project led by a bunch of retired southerners. The younger folks could swing their hammers a lot faster, but the old guys seemed to get a lot more done, and they'd always be saying things like "Well, this wood's a bit wet, so it's going to warp some, so you want to put the nail right there and give it a medium-hard whack on the top to get it into the right place." It's a lot easier to build things when all the raw materials are perfect, but it can be a lot more efficient to know what to do when they're not.
|
|
Previous Topic
