“Security for security’s sake.”
posts from 2013 / 01 / 16
-
-
On Modules and Gems and Similar Works
A family walks into a talent agency. It’s a father, mother, son, daughter and dog. The father says to the talent agent, “We have a really amazing act. You should represent us.”
“Sorry, I don’t represent family acts. They’re a little too cute.”
The mother steps forward.
“Sir, if you just see our act, we know you would want to represent us."
"OK. OK. I’ll take a look.”
First, I come out and pick a guy from the audience and ask him to pick a scripting language. It doesn’t matter what language he picks, we can do the act in Perl, Python, Ruby, R, you name it. We blindfold the guy and put him in an isolation chamber on stage so that he isn’t in the know on the middle of the act.
Then I go out and hold back the standard library in that language by weeding out anyone that hopes to improve it and distracting them with more interesting work. Meanwhile, my wife begins work on a much improved alternative and cutely named alternative to the problematic standard library.
So then, when she’s done, my son publishes her new library in the standard package manager using the cute name, but here’s the thing: he changes the name used to import it subtly. Say we call the library doubleagent in the package manager but to use it in a script, you have to import or use or require or whatever agentagent.
Then my daughter starts cranking out useful scripts that use the library. But she assigns the documentation to our dog! He never writes it!
This is where I come back in: I SEO a buncha ads for these great scripts with no documentation and don’t mention the module’s package managed name.
Then we go get the guy we picked from the audience and we take the blindfold off and we ask him to try to write a script that will almost definitely need our new libraries, only we give him a fresh server build to write it on so if he wants ‘em, he has to set up his environment first.
It’s all going ok until the guy decides to use our library (they always do, trust me). The guy doesn’t know agentagent doesn’t exist in the package manager because it’s really doubleagent but all the SEO articles I write act like everyone already knows this because I google dork for anyone that mentions it offhand and DMCA them into taking it down.
The act wraps with the guy from the audience having to search Stack Exchange type sites and waste 5 minutes of the entire theater’s life to find that agentagent is doubleagent. Once he figures this out, he files it away as language-lore and we forbid him from publishing anything about it.
For the longest time, the agent just sits in silence. Finally, he manages, “That’s a hell of an act. What do you call it?”
And the father says, “The Aristocrats!”
January 16th, 2013 9:47am