in reply to Re: Words from Theo de Raadt
in thread Words from Theo de Raadt

Half of the responsibility resides with library and module authors. First, they have to create sane and usable interfaces. Second, they have to document them clearly.

Most importantly, they have to make as few assumptions and interdependencies as possible -- and document the side effects where they can't avoid it. If your library can be used in a multi-threaded environment and, for some reason, a function cannot be interrupted for any reason, make it abundantly clear that there needs to be a mutex. Better yet, provide a different entry point to the function yourself.

Given clean and intelligent interfaces and effective documentation, the fault for misuse must lie with other people.

Until then, we all share responsibility.