btclib

understand why they like programming." -Rasmus Lerdorf "I'm not a real programmer. I throw together things until it works then I move on. The real programmers will say "Yeah it works but you're leaking memory everywhere. Perhaps we should fix that." I’ll just restart Apache every 10 requests." -Rasmus Lerdorf "I do care about memory leaks but I still don't find programming enjoyable." -Rasmus Lerdorf "I don't know how to stop it, there was never any intent to write a programming language [...] I have absolutely no idea how to write a programming language, I just kept adding the next logical step on the way." -Rasmus Lerdorf "I was really, really bad at writing parsers. I still am really bad at writing parsers." -Rasmus Lerdorf "I really don't like programming. I built this tool to program less so that I could just reuse code." -Rasmus Lerdorf "I actually hate programming, but I love solving problems." -Rasmus Lerdorf "For all the folks getting excited about my quotes. Here is another - Yes, I am a terrible coder, but I am probably still better than you :)" -Rasmus Lerdorf Then there was the time that Rasmus Lerdorf cut an official but fatally flawed public release of PHP 5.3.7 without bothering to run the unit tests, which would have caught his sloppy bug he just checked in that broke crypt(). This guy who thinks he's "probably still better than you" had to admit that maybe he "went a bit too fast" when he didn't actually bother to run any of the unit tests first before releasing a new version of PHP with a terrible security flaw in crypt(), because so many of the tests produced error messages, and even though the tests caught his bug, he didn't feel it was worth the hassle of wading through all those pesky error messages to see if he'd introduced yet another security related bug. I sure hope no online banks depend on the crypt() function! > 5.3.7 upgrade warning: [22-Aug-2011] Due to unfortunate issues with 5.3.7 (see bug#55439) users should postpone upgrading until 5.3.8 is released (expected in a few days). https://www.reddit.com/r/programming/comments/jsudd/you_see_... >r314434 (rasmus): Make static analyzers happy >r315218 (stas): Unbreak crypt() (fix bug #55439) # If you want to remove static analyser messages, be my guest, but please run unit tests after http://svn.php.net/viewvc/php/php-src/trunk/ext/standard/php... https://plus.google.com/113641248237520845183/posts/g68d9RvR... >Rasmus Lerdorf >+Lorenz H.-S. We do. See http://gcov.php.net >You can see the code coverage, test case failures, Valgrind reports and more for each branch. >The crypt change did trigger a test to fail, we just went a bit too fast with the release and didn't notice the failure. This is mostly because we have too many test failures which is primarily caused by us adding tests for bug reports before actually fixing the bug. I still like the practice of adding test cases for bugs and then working towards making the tests pass, however for some of these non-critical bugs that are taking a while to change we should probably switch them to XFAIL (expected fail) so they don't clutter up the test failure output and thus making it harder to spot new failures like this crypt one. "I throw together things until it works then I move on." -Rasmus Lerdorf

vious hacks[4], many more hack claims and the internal trading bot being traced by outside researchers. I don't blame anybody for not seeing these issues - there was a lot of FUD at the time and many who saw attacks on MtGox as attacks on Bitcoin. Nobody really wrote a good and concise "this is why you shouldn't use MtGox" post anywhere. Hearing after it was taken down that someone knew it was bad is useless and only self-serving. I don't think it is possible for a third party to hold your bitcoins for you in a secure way that is also convenient. You can pick any bitcoin company or exchange and claim its insecure and you'll eventually be right for many users. One of the only ways to avoid the problems and store your bitcoins safely but also still be able to use them is with a hardware wallet. There has been a lot of improvement since MtGox with "vault" products, better multisig implementations, better auth, and offline signing etc. but still some way to go. [0] https://bitcointalk.org/index.php?topic=179586.0 [1] https://bitcointalk.org/index.php?topic=209362.0 [2] https://techcrunch.com/2013/08/23/feds-seize-another-2-1-mil... [3] https://github.com/MagicalTux/btclib [4] http://www.dailytech.com/Inside+the+MegaHack+of+Bitcoin+the+...