Re: Removing dead code (was: Retrospective by 'gpg.fail' authors)
oss-security thread on removing dead code after the gpg.fail retrospective, with Peter Gutmann describing a decade-long deprecation and removal process.
In an oss-security mailing list thread following the gpg.fail authors' retrospective, Peter Gutmann described his gradual deprecation approach: turning dead code into a config option, then a disabled-by-default compile-time option with a #error notice, then permanent removal after roughly ten years without complaints. Jacob Bachmeyer participated in the discussion of maintenance practices for security code. The thread is community commentary rather than a new vulnerability disclosure.
- Gutmann deprecates via config options, then removal after ~10 years of silence
- Thread follows the gpg.fail authors' retrospective on dead code
- Products
- gpg.fail
- Organizations
- oss-security
From the original article
Posted by Peter Gutmann on Sep 18 Jacob Bachmeyer writes: That's exactly how I deprecate things: Make it a config option -> make it a disabled-by-default config option -> make it a disabled-by-default compile- time option with a #error if enabled telling users to contact me if they see the message.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.