Re:Don't encode POST bodies like GitHub Copilot, use URLSear...
by jandrese on Thursday July 01, 2021 @02:37PM
(#27702733)
I think of StackOverflow as basically crowdsourced documentation. In a perfect world the documentation that comes with your tools would be complete, correct, and readable. Unfortunately in our world this is often not the case and people end up having to do one of three things:
1. Delve into the original source to see what happens (or reverse engineer the binary) -- very time consuming!
2. Guess. Maybe write some test apps to play around with it till you get it working. This used to be very common, but leads to situations like the PS2 encryption algorithm being completely broken because the devs didn't understand the IV parameter.[1]
3. Go on StackExchange and find an example of what you are trying to do, usually with some helpful discussion about the parameters.
[1] You would think security libraries would have the best documentation because it's so important to get it right and difficult for the developer to detect mistakes, but I've found the opposite to be the case. They're some of the worst offenders for just showing you a cryptic function prototype and assuming you know everything about the underlying math already. It feels like the crypto guys think if you couldn't write your own crypto library then you aren't good enough to use theirs, kind of missing the point of libraries.
1. Delve into the original source to see what happens (or reverse engineer the binary) -- very time consuming!
2. Guess. Maybe write some test apps to play around with it till you get it working. This used to be very common, but leads to situations like the PS2 encryption algorithm being completely broken because the devs didn't understand the IV parameter.[1]
3. Go on StackExchange and find an example of what you are trying to do, usually with some helpful discussion about the parameters.
[1] You would think security libraries would have the best documentation because it's so important to get it right and difficult for the developer to detect mistakes, but I've found the opposite to be the case. They're some of the worst offenders for just showing you a cryptic function prototype and assuming you know everything about the underlying math already. It feels like the crypto guys think if you couldn't write your own crypto library then you aren't good enough to use theirs, kind of missing the point of libraries.