How do you decide whether to use a library or write your own implementation

后端 未结 7 2233
栀梦
栀梦 2021-01-31 18:40

Inspired by this question which started out innocently but is turning into a major flame war.

Let\'s say you need to a utility method - reasonably straightforward but no

7条回答
  •  半阙折子戏
    2021-01-31 19:07

    Another consideration is security.

    If a black-hat hacker finds a bug in your code they can create an exploit and sell it for money. The more popular the library is, the more the exploit worth. Think about OpenSSL or Wordpress exploits. If you re-implement the code, chances that your code is not vulnerable exactly the same way the popular library is. And if your lib is not popular, then an zero-day exploit of your code probably wouldn't worth much, and there is a good chance your code is not targeted by bounty hunters.

    Another consideration is language safety. C language can be very fast. But from the security standpoint it's asking for trouble. If you reimplement the lib in some script language, chances of arbitrary code execution exploits are low (as long as you know the possible attack vectors, like serialization, or evals).

提交回复
热议问题