←back to thread

349 points dgl | 2 comments | | HN request time: 0.396s | source
1. JdeBP ◴[] No.44503957[source]
Reading someone quote Jon Postel in the context of CR+LF brings back memories.

* https://jdebp.uk/FGA/qmail-myths-dispelled.html#MythAboutBar...

"that may not be the most sensible advice now", says M. Leadbeater today. We were saying that a lot more unequivocally, back in 2003. (-:

As Mark Crispin said then, the interpretations that people put on it are not what M. Postel would have agreed with.

Back in the late 1990s, Daniel J. Bernstein did the famous analysis that noted that parsing and quoting when converting between human-readable and machine-readable is a source of problems. And here we are, over a quarter of a century later, with a quoter that doesn't quote CRs (and even after the fix does not look for all whitespace characters).

Amusingly, git blame says that the offending code was written 19 years ago, around the time that Daniel J. Bernstein was doing the 10 year retrospective on the dicta about parsing and quoting.

* https://github.com/git/git/commit/cdd4fb15cf06ec1de588bee457...

* https://cr.yp.to/qmail/qmailsec-20071101.pdf

I suppose that we just have to keep repeating the lessons that were already hard learned in the 20th century, and still apply in the 21st.

replies(2): >>44504337 #>>44505677 #
2. emmelaich ◴[] No.44505677[source]
> As Mark Crispin said then, the interpretations that people put on it are not what M. Postel would have agreed with.

Absolutely, in particular the "Be conservative in what you do" would have prevented this bug.