Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Imho, it's a scalability issue.

Was OpenSSL secure when it was originally written in X lines of code? Very likely.

Is it feasible to expect it to be secure now that it's X^Y lines of code, when a large class of bugs can exist in any line of code? No.

That's what 15 years of an evolving codebase has taught us. Which is reasonable, given that a lot of open source projects came into existence in the mid-90s. Inculcate lesson, design language for next 15 years. Not that radical.



Does it really matter whether it's a scalability issue though? The bottom line is that the code has bugs, whether it's due to the fact that the codebase is large is somewhat irrelevant.


By scalability, I meant more along the lines of, "Is it possible/efficient/reasonable to write large, secure codebases in language X using process Y?"

Answer A is "Yes, bugs come from bad development practices or unskilled programmers."

Answer B is "No, there are fundamental issues with the language that make it unreasonable to expect a secure product."

In other words, are the primary sources of bugs programmers or the ways the language forces them to interface with it?




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: