On Fri, 10 Mar 2006 19:40:54 +0100, Jan Luehr said: > well, this takes me to a difficult question: > How much more are to come? (Have you begun a code audit? How long will it > take > then?)
Common wisdoms tells that it is pretty ineffective for a developer to audit his own code. Despite that developer prefer writing new code, I would really like to put more time into quality assurance. First of all this means writing regression tests and more tests and still more tests. Then and only then we could start cleaning up the code to get rid of stuff required 8 years ago but which is by now mostly obsolete. Without enough support contracts or other financial resources we can't really do that. David Wheeler's SLOCcount estimates the development effort for gnupg-1.4 at 30 person years. And that does not even take into account that GnuPG can't be estimated using the basic COCOMO; in reality it will be much higher. A code audit would be at least that expensive. > I haven't been following the gnupg development so far, but imho the recent > development of actions rater is rather disturbing - and these kind of bugs > tend to disqualify gnupg from mission critical use. Do you really believe it is different with other applications or even with the Linux, which is the most sensitive part of the OS? I do quick audits from time to time to figure out what application to use for a specific task: there is so much horrible flawed software in production use that I sometimes want to plug out the network cable immediately. That is not to say that proprietary software is in any regard better; just to the contrary: all non free mass market software hampers from the probelm that there is not enough quality checking. And well, who is going to do that? Shalom-Salam, Werner p.s. Sorry for replying so late to some message; I accidently unsubscribed from users and didn't noticed. _______________________________________________ Gnupg-users mailing list [email protected] http://lists.gnupg.org/mailman/listinfo/gnupg-users
