We Are Morons: a quick look at the Win2k source (2004)

http://www.kuro5hin.org/story/2004/2/15/71552/7795

by oscardelben • 17 years ago

88 48 17 years ago

edw519• 17 years ago

"Comments like "UGLY TERRIBLE HACK" tend to indicate good code rather than bad: in bad code ugly terrible hacks are considered par for the course."

For Microsoft or for everyone?

garply• 17 years ago

I agree with his assessment. Sometimes ugly terrible hacks are the best solution given the external constraints (time, 3rd party code beyond your control, whatever). And if you have an ugly terrible hack, you should definitely comment it.

codemonkey• 17 years ago

Yes, but then you should go back and fix it. One can only hope that there were more "ugly hacks" that have since been fixed.

The measure of a good programmer is not whether he or she recognizes when they're writing bad code, but whether the final result is free of bad code, and thus more maintainable.

I would argue that someone commenting known bad code, but leaving it there in perpetuity is no better than someone unknowingly writing bad code (although the comments could serve as signposts to help someone else find and fix your bad code - but how often has that ever actually happened?).

sep332• 17 years ago

It's not a well-worded sentence, but what he means is that if you have to call out an ugly hack, the REST of the code is probably pretty decent. If the code is full of ugly hacks, they wouldn't be worth mentioning.

blogimus2• 17 years ago

I think an important point is that the programmer recognized that what he/she was doing was an ugly hack, (presumably under some serious constraint, like time) and felt compelled to point this out.

A mediocre programmer might come up with the same fix, but not recognize that the fix was an ugly hack, and not comment as such.

frossie• 17 years ago

I agree with the OP that this is a positive sign. The only thing that surprises me it that it seems to be a free-format arrangement of a word that can be used in a positive way. We have a magic comment word ("kludge", if you must know) that we use for code that we wish we had time to write better; that in principle allows us to go back and find things to fix after the fact, or helps troubleshooting since kludges are more likely to break.

far33d• 17 years ago

I don't agree. I think all code of any size, bad or good, has these words in it. The problem with his statement is that "UGLY TERRIBLE HACK" is relative. One man's terrible hack is another man's normal day-to-day style. In bad code, there are just more ugly hacks that aren't commented as such.

brc• 17 years ago

Show me a programmer who has never implemented an ugly terrible hack, and I'll show you someone who has never shipped any code.

tptacek14• 17 years ago

This is old news, obviously. It's worth pointing out that as good as the code appeared to these reviewers in 2004, between then and now, Microsoft underwent a sea change in code-level quality control. Windows is now likely to be the best reviewed, most rigidly compliant code shipping on the market:

* Virtually every Microsoft senior developer has been trained on software security

* All shipping code is checked in-house, including some homegrown static analysis tools

* Most shipping products have had line-by-line source code reviews done by at least two different firms (we did some of this work for Vista).

During the Summer of Worms in '03, when Microsoft security lapses were front-page material on CNN, Bill Gates told the press that Microsoft was going to totally overhaul security and code quality. They weren't kidding. Microsoft now outspends everybody on that.

Note: I'm a Mac person.

alyx• 17 years ago

Amazing how people can only say anything favorable about Microsoft if they hide behind the guise of a competing company. God forbid a PC guy had this opinion.

Up voted none the less.

Note: I'm a Mac and a PC person.

tptacek14• 17 years ago

If I don't say I'm a Mac person, people say I'm a shill. It's also just the truth --- I don't want to imply I like using Windows (although I like Vista more than I like XP).

jacoblyles• 17 years ago

In any topic that arouses people's passions, I find that if I want to say something nice about hated group X, then if I don't identify myself as a non-X, then people dismiss what I say as another one of those "damn X-ers".

It's irrational, yes. But that's human nature for you.

What's surprising, and perhaps sad, is that operating systems have aroused people's passions so intensely that it has become one of those volatile topics, like the canonical religion and politics, that one must treat very carefully, and certainly not bring up at dinner.

Herring3• 17 years ago

Note that there's a limit. They're not willing to do what ubuntu does for security eg add a repository, remove wga, release analysis tools, etc.

tptacek14• 17 years ago

I think you could make that argument but you'd lose. To an extent not well covered in the trade press, a lot of the pain in Vista --- an epic flop --- was due to tradeoffs Microsoft made for security and against end-user happiness.

10ren2• 17 years ago

They're not willing to do what ubuntu does for security eg ... release analysis tools

Data point: Microsoft released a security assessment tool - they even open sourced it (note: title is misleading): http://it.slashdot.org/article.pl?sid=09/03/22/147202

chanux2• 17 years ago

/Most shipping products have had line-by-line source code reviews done by at least two different firms (we did some of this work for Vista)/

But Vista was more of a fail I guess.

* I'm a GNU/Linux person

tptacek14• 17 years ago

In the market, yes. In security, no.

chanux2• 17 years ago

Microsoft is getting over their failures, but not the lame fanboys. It's clear.

cperciva• 17 years ago

Most shipping products have had line-by-line source code reviews done by at least two different firms (we did some of this work for Vista).

I'm impressed. You probably can't tell me, but just in case... how much do you charge for this?

Considering how many LOC there are in Vista, either you're far cheaper per LOC than I expected, or Microsoft put up a huge amount of money.

tptacek14• 17 years ago

If someone ever writes a proposal for you priced by the lines of code, run in the other direction. It's one of the big scams in our industry, the "oh, we'll just scope the project directly off your estimated line count" thing.

Our practice focus is on code-assisted penetration testing; in other words, we'll read your code, but mostly to get a sense of what it does and how it's articulated. Then we'll write software to beat the shit out of it.

The nice thing about this is, projects are scoped by what the code does, and how exposed it is to attack, not by some arbitrary number.

I'd love to talk about the specifics of what we did for this customer, but I'm only able to say "Vista" because Microsoft publicly said we worked on it.

Devilboy• 17 years ago

Wow I guess you CAN fix these problems by just throwing enough resources at it and doing it consistently.

tptacek14• 17 years ago

I don't know how we convinced ourselves that money couldn't buy software quality.

maweaver• 17 years ago

What's interesting to me is the comments. I worked in a corporate environment that seemed to me at the time to be overly-paranoid about open source (any use of open source software had to be run past a legal team). After seeing people argue that Microsoft's millions of lines of code is in violation of the GPL due to a single Makefile, I have more sympathy for their concerns.

TheAmazingIdiot• 17 years ago

Good heavens. You mean that people really are claiming copyright violation on a makefile? Egads.

Now, i never really got the idea of source pollution if the source is never grabbed to begin with. All projects that rely purely on the GPLv2 have the same 'legal requirement', unless that code generates more code. Then, well, let the lawyers decide that one. I'm thinking of the license from gcc and like.

Erwin• 17 years ago

And even that claim was baseless as it was made based on a filename: GNUMakefile is a filename that GNU Make looks for before "Makefile". This allows the same directory to have a Makefile for traditional make and one used for GNU Make.

mpk• 17 years ago

Considering the size of the codebase and the amount of developers that have contributed to it over time, I find the comments to be very mild.

Every commercial codebase has hacks and special cases. Limited developer resources, deadlines and idiotic external constraints (hello third party libs/apps!) simply force that.

There is an art to capturing stupid stuff that is beyond your control at the integrating level (with checks, logging and exceptions at that level) without allowing this to contaminate the deeper levels of your system. That's another story entirely.

If you want to read some highly amusing comments in source, read http://www.jwz.org/doc/censorzilla.html - the list jwz published of the stuff that had to be removed from the Netscape source code before it was open-sourced.

shimi• 17 years ago

I couldn't stand The undocumented Windows API scene. It gave me such a hard time. I find it amusing that the MS guys had to deal with that!!!!

10ren2• 17 years ago

it's hard to see Microsoft's operating system competitors taking advantage of it.

Wine.

If I was them, I wouldn't be interested in copying it, but I would be interested in seeing how things were actually done (to confirm inferences as well as resolving puzzles.) But I believe that even seeing code leaves you open to a copyright infringement suit, which is why people do clean room reverse engineering. So, I wouldn't even look at it if I was them - despite my interest :-(.

We Are Morons: a quick look at the Win2k source (2004)

Related Stories