News for hackers. Stuff that matters.
Re:Alpine Linux Security advisory: OpenSSH-server password a... by spullara on Thursday November 05, 2026 @01:22PM (#50382481)
always has amazed me that there was so much hate for java checked exceptions where handling errors ought to be the norm.
Re:Alpine Linux Security advisory: OpenSSH-server password a... by kaoD on Thursday November 05, 2026 @01:29PM (#50382599)
I agree but I think was also because Java didn't have sum types (or still doesn't? years I haven't read Java) and rethrowing is super easy, while Rust kinda nudges you into the right direction (if you need to rethrow at all, think if you want to rethrow verbatim or wrap with a semantic error type).

Right idea at the wrong time.

Re:Alpine Linux Security advisory: OpenSSH-server password a... by zmmmmm on Thursday November 05, 2026 @03:49PM (#50384299)
yep, 90% ergonomics in my view. If it had its time again with modern ergonomics thing could look very different.
Re:Alpine Linux Security advisory: OpenSSH-server password a... by groestl on Thursday November 05, 2026 @01:35PM (#50382678)
The question is _where_ the error needs to be handled. It's almost never directly at the call site. And then there's a few issues with checked exceptions and Java language things (RMI, closures, etc) which make checked exceptions cumbersome. An exception (checked or not) might be worse than sum types, but they're still a thousand times better then returning an error in-band.
Re:Alpine Linux Security advisory: OpenSSH-server password a... by spullara on Thursday November 05, 2026 @02:56PM (#50383646)
Rust and Go literally have you handle it at the call site by default and if you don't want to you have to pass it on.
Re:Alpine Linux Security advisory: OpenSSH-server password a... by groestl on Thursday November 05, 2026 @06:36PM (#50386142)
Which (at least the way it was done in Go) is ignoring 20 years of experience in programming language design.
Re:Alpine Linux Security advisory: OpenSSH-server password a... by mahboi on Thursday November 05, 2026 @06:41PM (#50386182)
Go doesn't require you to handle it at all. Rust made the right compromise with !
Re:Alpine Linux Security advisory: OpenSSH-server password a... by drdec on Thursday November 05, 2026 @02:57PM (#50383668)
> The question is _where_ the error needs to be handled. It's almost never directly at the call site.

Which is why exceptions in Java can bubble up the stack? You don't have to catch it in a particular method you can let it go to the caller of the method, and so on.

Re:Alpine Linux Security advisory: OpenSSH-server password a... by mahboi on Thursday November 05, 2026 @06:40PM (#50386173)
Checked exceptions must be handled or declared. You end up with everything saying it can throw several random things like IOException.
Re:Alpine Linux Security advisory: OpenSSH-server password a... by javier2 on Thursday November 05, 2026 @01:36PM (#50382701)
They were overused, but some actually make sense, such as the IOException and SQLException
Re:Alpine Linux Security advisory: OpenSSH-server password a... by cloverich on Thursday November 05, 2026 @03:26PM (#50384023)
The problem with them all always comes when the ever-steady march of abstractions, features, and edge cases results in one routine throwing the same two error classes but in different places, and how you handle them is different despite being the same wrapper. Add a thousand developers and several years of churn, and poof you get extremely complex bugs that result from errors seeming to come from one place, but actually coming from another.

Having been on the receiving end of debugging that a few times, I no longer mind the in-band error handling, although admittedly I'm inexperienced enough to be confident its better. Just for the random code I've had to read where I just need to know exactly how something I didn't write and will never read again works, and whether the error is handled and how, i love reading in-band error handling, even if I too dislike the way an error laden routine must be written. Over time I've come to appreciate elegance "in the large" as opposed to the code I see in any individual function.

Re:Alpine Linux Security advisory: OpenSSH-server password a... by Terr_ on Thursday November 05, 2026 @01:56PM (#50382925)
[delayed]
Re:Alpine Linux Security advisory: OpenSSH-server password a... by sieve on Thursday November 05, 2026 @02:00PM (#50382964)
In the vast majority of programs, errors and non-results are irrelevant at the call site. You want to program for the happy path and not wrap every single call with error checking code or `try/catch/finally`.

    h = file_open(path)
    data = file_read(h)
    file_close(h)
    return data
is the code you want to read. This essentially is:

    return file_open(path).success(h -> h, file_read(h)).success(h, data -> file_close(h); data)
A language with thoughtful error handling primitives will support such code.
Re:Alpine Linux Security advisory: OpenSSH-server password a... by spullara on Thursday November 05, 2026 @02:58PM (#50383676)
that is the same as saying the method throws IOException
Re:Alpine Linux Security advisory: OpenSSH-server password a... by sieve on Thursday November 05, 2026 @03:28PM (#50384052)
It might throw one. There is a difference between documenting what exceptions can be thrown and forcing every consumer to handle them.
Re:Alpine Linux Security advisory: OpenSSH-server password a... by spullara on Thursday November 05, 2026 @04:10PM (#50384489)
returning a non-success you either handle it or pass it up the chain, potentially with not a lot of information about what originally caused it. with an exception you can retain the full information about what happened by either rethrowing it, throwing your own exception with it embedded as the cause or declaring that you don't handle it by saying you can throw it.
Re:Alpine Linux Security advisory: OpenSSH-server password a... by sieve on Thursday November 05, 2026 @04:42PM (#50384856)
I generally prefer exceptions to result codes. You can even use the mechanism to throw useful results across nested function calls.

I do prefer Maybe/Option/Either style returns in some cases though. Makes for a cleaner API.

So each method has its uses.

Re:Alpine Linux Security advisory: OpenSSH-server password a... by spullara on Friday November 06, 2026 @06:00PM (#50399656)
I also have this nuanced view. I am glad my hashmaps don't throw KeyNotFoundException.
Re:Alpine Linux Security advisory: OpenSSH-server password a... by mahboi on Thursday November 05, 2026 @06:34PM (#50386128)
Eh, it's weird. You usually don't care exactly what type of exception is thrown. If you do, usually you only care about that one type and the rest fall into the "unexpected error" category. HTTP did this well with 4xx being client's fault and 5xx being server's fault.
Re:Alpine Linux Security advisory: OpenSSH-server password a... by pandemic_region on Thursday November 05, 2026 @04:30PM (#50384713)
IOException must be #1 on the list of most ignored exceptions. Like okay what am I supposed to do really I'm just trying to run a select against my db
Re:Alpine Linux Security advisory: OpenSSH-server password a... by pie_flavor on Thursday November 05, 2026 @06:12PM (#50385889)
Well, for example, if you had opened a file to put the data into, you might delete the file or restore from a backup. But even if the answer is nothing, bubbling it all the way up to main is not the wrong answer. The point isn't whether you can do something, it's whether someone can do something.
Re:Alpine Linux Security advisory: OpenSSH-server password a... by zmmmmm on Thursday November 05, 2026 @03:48PM (#50384285)
> You want to program for the happy path

This is the root of a lot of the evil. Yes, humans want to program for the happy path. It is a lot more fun. However, that bias leads to so much lack of diligence to properly deal with the unhappy path.

Re:Alpine Linux Security advisory: OpenSSH-server password a... by sieve on Thursday November 05, 2026 @03:54PM (#50384347)
Syntax is not going to solve logic errors. No amount of checked exceptions or forced unwrapping of a result will help with TOCTOU or any number of similar vulnerabilities in code.

You ideally want to attack the problem at two ends:

- make the syntax noise-free so you can see what is happening

- build primitives at the syscall and stdlib level for common footguns

You would still need to deal with domain-specific logic errors, but you have at least reduced the surface area exposed to casual attacks.

Re:Alpine Linux Security advisory: OpenSSH-server password a... by mahboi on Thursday November 05, 2026 @06:30PM (#50386069)
People using exceptions want to handle the unhappy path, just usually not at the call site.
Re:Alpine Linux Security advisory: OpenSSH-server password a... by groestl on Thursday November 05, 2026 @06:43PM (#50386207)
> This is the root of a lot of the evil

It is not. Being extremely restrictive in the happy path, throwing all over the place, but have generic error handling code at the top level (e.g. HTTP entry point) makes for some pretty robust, stable, easy to read software. Albeit it typically has somewhat rough user experience.

The thing is, that's a pretty good place to start. From there on, you can handle exceptions one by one, surgically, and make things nicer.

Re:Alpine Linux Security advisory: OpenSSH-server password a... by mahboi on Thursday November 05, 2026 @06:54PM (#50386290)
I keep hearing how diligent it is to handle errors at the call site, always by people who end up making services that either crash for preventable reasons or bury errors.
Re:Alpine Linux Security advisory: OpenSSH-server password a... by _flux on Thursday November 05, 2026 @02:21PM (#50383219)
I always thought the ideas was great, but type system was holding it back. If you could have expressed that your thrown exceptions are the same as some other method's (e.g. a method of a class given as a parameter), and some other classes, then it could have been a lot less annoying. Powerful, even! But Java did take its sweet time to get even type parameters.

I have written very little Java, though, so this is more of an armchair analyst position.

Re:Alpine Linux Security advisory: OpenSSH-server password a... by 0x457 on Thursday November 05, 2026 @04:29PM (#50384709)
Better design breeds better habits. In Java, you can end up handling a DNS exception 20 layers up the stack, even if your call never actually triggers a DNS lookup, simply because some method deep in the call stack declares it as possible. The culture is to propagate or wrap exceptions rather than translate them into domain-specific errors near the source.

Rust makes handling and mapping `Result` locally more ergonomic, even though `?` makes propagation easy too. Rust, however, also makes it easy to lose the context during propagation and end up with useless `Error`.