Re:Never Reinventing the Wheel Is Anticompetitive
by JadeNB on Saturday November 22, 2014 @09:37PM
(#8647612)
> I guess I could have dodged heartbleed if I'd written my own TLS library and avoided any software that depended on OpenSSL. Considering the effort involved, I think I'll take heartbleed and rotate my keys.
Although I actually agree with the conclusion of this essay (that, to paraphrase, "don't re-invent the wheel" really means "don't re-invent the wheel if you're trying to invent the car"), I thought that this was really the weak point in the posted argument. Sure, if everyone wrote his or her own TLS library, then we wouldn't have Heartbleed—but instead we'd have a litany of tiny bugs leading to everyone getting exploited in his or her own way. Similarly, the advice "don't roll your own cryptography" doesn't mean that there's no room for new cryptographic schemes, just that it's a lot more likely that the bugs that your scheme would include will have been ironed out in an existing one.
Taken to extremes, the argument becomes "don't use an existing OS, because then you'll get bitten by any bug in that OS"!
P.S. Just to be clear, though I am replying to you, the arguments above (to which I suspect you are sympathetic) are rather addressed to the author of the post.
Although I actually agree with the conclusion of this essay (that, to paraphrase, "don't re-invent the wheel" really means "don't re-invent the wheel if you're trying to invent the car"), I thought that this was really the weak point in the posted argument. Sure, if everyone wrote his or her own TLS library, then we wouldn't have Heartbleed—but instead we'd have a litany of tiny bugs leading to everyone getting exploited in his or her own way. Similarly, the advice "don't roll your own cryptography" doesn't mean that there's no room for new cryptographic schemes, just that it's a lot more likely that the bugs that your scheme would include will have been ironed out in an existing one.
Taken to extremes, the argument becomes "don't use an existing OS, because then you'll get bitten by any bug in that OS"!
P.S. Just to be clear, though I am replying to you, the arguments above (to which I suspect you are sympathetic) are rather addressed to the author of the post.