[hinkley]

There are bugs that certain games rely on and features that some don’t use. I’m currently trying to optimize a library out of spite. (I want it to work better than the competitor that caused me a lot of problems on a recent project). The amount of conditional logic around what is essentially a function to increment a value is breathtaking.

[gatlin]

Do you have any kind of example you're able to share? I don't mean to take your IP but I want to see this breathtaking vista.

[amiga386]

A simple example would be that the function glGetString(GL_EXTENSIONS) crashes the original Quake engine and many licensees, because it's expecting no more than a 256 character string.

The driver looks to see if a known old game is calling it, and if it's one known to crash, it returns no more than 256 characters, and likely also puts all the _old_ extensions that the game is likely to know and react to in the string.

There are also all sorts of games that called APIs in a particular order or set particular options, because they represented a "fast path" at the time, and now they don't, but if you're that program, then yes they do.

Ultimately, this clutter is what let do the development of the Vulcan API, to stop games second-guessing graphics APIs which themselves second-guess the games.

[hinkley]

To avoid doxxing myself: In a deep call stack it’s possible to end up sanitizing inputs multiple times and in different ways.

A frequent example I’ve encountered is web frameworks that have to keep checking for escaped text because they didn’t write it in horizontal layers where you know for sure that all inputs have been scrubbed when they reach this function but not that one. So the same functions get called with data that comes from your team and from customers. Reuse is tricky.

[hamburglar]

“Checking for escaped text” is the sort of nonsense that tells you you’re dealing with amateur developers.

[withinboredom]

Indeed. The rules are simple:

- Unescape, sanitize or validate at all entry points.

- Escape all outputs (this includes the database queries).

If you follow those simple rules, you never have to check once you are past a controller. And you should fuzz your controllers to make sure no unexpected data makes it past there.

[hinkley]

Thing about taking a job is they don’t generally let you look at the code first and nope out if it’s fucked six ways to Sunday.

Everyone has clever answers for greenfield projects and empty rhetoric for brown.