On Sun, Feb 13, 2022 at 02:40:42PM +0000, G.W. Haywood via perl5-porters wrote:
> Hi there,
>
> On Sat, 12 Feb 2022, Dan Book wrote:
> > On Sat, Feb 12, 2022 at 4:15 PM G.W. Haywood via perl5-porters wrote:
> > > On Sat, 12 Feb 2022, Ricardo Signes wrote:
> > > > ...
> > > > Open questions:
> > > > * Is it permissible to unexport a lexically exported subroutine? ...
> > >
> > > Depends on how you feel about things crashing.
> >
> > What do you mean? ...
>
> I mean that when I read posts on this list sometimes I feel a bit like
> a twelve year old mountain boy who's just jumped on his bobsleigh to
> head to the toyshop in town. It seemed like a good idea to him at the
> time but he's starting to wonder what will happen when he gets there.
>
> A whistle-stop history:
>
> 8<-----------------------------------------------
> 2000-03-22: $ grep crash perl5060delta | wc => 0
> 2002-07-18: $ grep crash perl5080delta | wc => 4
> 2007-18-12: $ grep crash perl5100delta | wc => 0
> 2010-04-12: $ grep crash perl5120delta | wc => 3
> 2011-05-14: $ grep crash perl5140delta | wc => 34
> 2012-05-20: $ grep crash perl5160delta | wc => 27
> 2013-05-18: $ grep crash perl5180delta | wc => 30
> 2014-05-27: $ grep crash perl5200delta | wc => 33
> 2015-06-01: $ grep crash perl5220delta | wc => 29
> 2016-05-08: $ grep crash perl5240delta | wc => 6
> 2017-05-30: $ grep crash perl5260delta | wc => 23
> 2018-06-22: $ grep crash perl5280delta | wc => 10
> 2019-05-22: $ grep crash perl5300delta | wc => 1
> 2020-06-20: $ grep crash perl5320delta | wc => 1
> 2021-05-20: $ grep crash perl5340delta | wc => 1
> 8<-----------------------------------------------
>
> Of course this is more than a little superficial but it seems to tell
> me that things went astray for the better part of a decade from 2010,
> before getting back onto an even keel. Hopefully the stability will
> continue to improve, and may even in future be taken for granted, but,
> if development is more a pot pourri of feature-creep than a journey to
> a clearly defined objective, then year on year I fear that we may see
> these numbers creeping back up again.
Your analysis is probably backwards.
We document when we find and fix crashes, not when we create them. (We abhor
regressions, so if a crash is detected as the side effect of a new feature,
that new feature would be reverted rather than ship with a new crash)
You *seem* also to be assuming some correlation between when crashes are
discovered (and documented) and when they were (inadvertently introduced).
For example, that crashes are found the year after they shipped.
If that were true, then yes, one could reasonably argue that things
stabilised in the past 4 years. The reality is that crashes have lain
undiscovered for many years, and some even since perl 5.000 shipped. As
better tools became available (valgrind, ASAN, Coverity, fuzzers) we've been
finding (and fixing) ever more of these subtle bugs. (And hence documenting
them)
So if anything, the counts above *might* indicate that the decade you
describe as "astray" was actually the golden decade, and since then we've
got worse at improving things.
I don't think that this is the reality either. If anything, the incentives
for security researchers to find bugs has increased, and the tools have
continued to improve. So we *ought* to be seeing higher crashes found and
fixed, if the quality of the code remained approximately constant (and so
chance of finding a bug remained constant).
I suspect more what we're seeing here is that it's getting harder to find
crashing bugs. We used to get several reports to
perl-s...@perl.org
per year with "fuzzing found this crash". We're now down to one or two a
year. If so, this would suggest that our code quality is improving. Not
getting worse.
Nicholas Clark