Re: Removing dead code (was: Retrospective by 'gpg.fail' authors)
oss-security thread on removing dead code after the gpg.fail retrospective, with Peter Gutmann describing a decade-long deprecation and removal process.
In an oss-security mailing list thread following the gpg.fail authors' retrospective, Peter Gutmann described his gradual deprecation approach: turning dead code into a config option, then a disabled-by-default compile-time option with a #error notice, then permanent removal after roughly ten years without complaints. Jacob Bachmeyer participated in the discussion of maintenance practices for security code. The thread is community commentary rather than a new vulnerability disclosure.
- Gutmann deprecates via config options, then removal after ~10 years of silence
- Thread follows the gpg.fail authors' retrospective on dead code
Posted by Peter Gutmann on Sep 18 Jacob Bachmeyer writes: That's exactly how I deprecate things: Make it a config option -> make it a disabled-by-default config option -> make it a disabled-by-default compile- time option with a #error if enabled telling users to contact me if they see the message. If after about 10 years no-one has complained, disable it permanently and eventually remove it on the next major release. However, this is a...
This source does not provide full text. Read it at seclists.org.