Hacker News Reader

Comment by jamesaguilar | Hacker News Reader

I wish that there was some widely agreed upon standard for "considered harmful" articles. Like, they have to be serious problems. They can't just be nitpicks or of the "this will mislead the already clueless layman when the press gets wind of it" bent.

There are so many vulnerabilities and exploits developed every year. How can it matter very much if a small handful of them are rewarded more substantially and disclosed using a slightly different than normal procedure? Pwn2own considered a wash, if you ask me.

View on HN

There are so many exploits developed every year. How can it matter very much if I disclose mine? Someone else will, I'm sure. They're all running the same JS fuzzer farms, after all. Who cares if Latvian organized crime gangs find it first? Someone good will find it eventually. Or at least reverse it out of the rootkits.

The problem isn't simply that the procedure is different. It's that the procedure is clearly, obviously, demonstrably sub-optimal. The Chrome bug-bounty, which Zalewski is surely involved with, runs year-round. The incentive is, you find something, you file it with them ASAP before someone else does. The same is not the case with CanSec's Pwn2Own, where, for no reason other than marketing for ZDI and CanSec, disclosure happens at one precise time during the year.

“Considered Harmful” Essays Considered Harmful http://meyerweb.com/eric/comment/chech.html

The original "considered harmful" article was essentially one big nitpick, so this use is probably quite appropriate.

Wiktionary defines "nitpick" as "To correct minutiae or find fault in unimportant details." But "Go To Statement Considered Harmful" (http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.92....) is not about minutiae or unimportant details; it is about how to approach the task of writing a computer program that does what you want instead of something else, a task that is at the core of the modern economy.

It focuses on the largely insignificant debate over the merits of one syntax structure over another. It's essentially the vi versus emacs of programming.

It sounds like you haven't read it. Please read it before you attempt to comment on it.

There's a difference between a nitpick and a paper that basically defines a new programming paradigm (or delineates the need for it compared to another paradigm).

Reply on news.ycombinator.com