[HN Gopher] The Most Backdoor-Looking Bug I've Ever Seen: Apple'...
       ___________________________________________________________________
        
       The Most Backdoor-Looking Bug I've Ever Seen: Apple's goto fail bug
       (2014)
        
       Author : MrXOR
       Score  : 34 points
       Date   : 2021-01-16 08:45 UTC (14 hours ago)
        
 (HTM) web link (dwheeler.com)
 (TXT) w3m dump (dwheeler.com)
        
       | tester756 wrote:
       | >The problem with 'goto' is that it allows developers to create
       | 'flow' in code that is unnatural... and that's bad because
       | developers should always strive to make code easy to read.
       | 
       | Those aren't mutually exclusive
        
       | dwheeler wrote:
       | Hi, I'm the author of the referenced article. Thanks for pointing
       | to it!
       | 
       | However, can you change HN thread to the article title, which is:
       | "The Apple goto fail vulnerability: lessons learned"?
       | 
       | I _never_ used the term  "backdoor" in the entire article, and I
       | certainly never claimed that this was an intentional backdoor. I
       | said, "The Apple goto fail vulnerability was a dangerous
       | vulnerability that should have been found by Apple." - but I
       | never said it was intentional. I personally doubt it was
       | intentional (it's possible, but I have no specific evidence
       | suggesting it).
        
         | gigatexal wrote:
         | Flagged in hopes the title gets changed
        
         | pansa2 wrote:
         | The OP has re-used the title of an unrelated article posted a
         | few days ago, for some reason:
         | 
         | https://news.ycombinator.com/item?id=25726068
        
       | Jerry2 wrote:
       | Title of this story is heavily editorialized. The article
       | mentions nothing about the backdoor.
        
       | CoolGuySteve wrote:
       | Meh, I worked on C at Apple and that programming style was
       | idiomatic there. There's nothing malicious about it, it was
       | almost certainly a diff tool or merge error that resulted in the
       | duplicated line.
        
       | netsharc wrote:
       | One of the ideas to make this error visible is to forbid
       | misleading indentation (section 3.5). It would be cool if the IDE
       | can show this goof straight away..
        
         | [deleted]
        
         | comex wrote:
         | These days, both GCC and Clang have a compiler warning about
         | it:
         | 
         | https://developers.redhat.com/blog/2016/02/26/gcc-6-wmislead...
         | 
         | However, for some reason, while GCC puts it under -Wall, Clang
         | (which Apple uses) doesn't enable it even with -Wall -Wextra;
         | you have to manually add -Wmisleading-indentation. It's also
         | not enabled by the default Xcode template.
        
         | Forge36 wrote:
         | Code Formating tools can help avoid this too.
        
       | bobbylarrybobby wrote:
       | For as long as I live, I'll never understand style guides that
       | permit omitting brackets around a single line following an if
       | statement (or for, while, etc), nor code formatters that dont
       | automatically insert them.
        
         | kevin_thibedeau wrote:
         | They add visual noise. The grammar of C is not the same as the
         | grammar of it's offshoots and block statements aren't part of
         | control structures. Moreover, GCC warns about extra statements
         | with the same indentation level with -Wall on.
        
           | tpush wrote:
           | IMO you get accustomed to single statement-braces very quick
           | and they leave less room for errors.
        
         | lucasyvas wrote:
         | I agree - it should be a compile or runtime error.
        
           | umvi wrote:
           | Well if you compile with `-Werror -Wall` (and you should), it
           | would throw in error in GCC 6+:
           | 
           | https://developers.redhat.com/blog/2016/02/26/gcc-6-wmislead.
           | ..
        
         | jimbob45 wrote:
         | It can make code bloated and harder to follow.
         | 
         | TBH it would be nice if someone made C with indent scoping
         | instead of block scoping but I don't think that's truly
         | practical with the preprocessor.
        
       ___________________________________________________________________
       (page generated 2021-01-16 23:01 UTC)