Coding Horrors: You can gather all your technical debt into one easy framework!

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Coding Horrors: You can gather all your technical debt into one easy framework!

«‹›1503 »

Deep Dish Fuckfest: Sep 6, 2006; Advanced
Computer Touching; Toilet Rascal

Shumagorath posted:

Our company's basic screening test has applicants write a modified version of strcmp(). This week, someone submitted some code that just took the two strings and summed their ASCII values char-by-char and made the final comparison based on that.

Well clearly it's a probabilistic version of strcmp().

# ? Aug 1, 2010 22:24

Adbot: ADBOT LOVES YOU

# ? Jun 3, 2024 12:00

HFX: Nov 29, 2004

Shumagorath posted:

Our company's basic screening test has applicants write a modified version of strcmp(). This week, someone submitted some code that just took the two strings and summed their ASCII values char-by-char and made the final comparison based on that.

This guy has a masters degree _{from Guelph}.

Pretty standard stuff there honestly. As in I see it all the time.

# ? Aug 2, 2010 16:26

Vanadium: Jan 8, 2005

It would work for reasonably short strings (or if you have reasonably big integers) if you multiply each n'th character's value by 256 to the n'th power. :colbert:

# ? Aug 2, 2010 20:05

HFX: Nov 29, 2004

Vanadium posted:

It would work for reasonably short strings (or if you have reasonably big integers) if you multiply each n'th character's value by 256 to the n'th power.

How is this any better then doing a comparison returning -1, 0, 1 on first difference unless I'm using something special that allows me to roll that up in one instruction?

# ? Aug 2, 2010 20:15

Vanadium: Jan 8, 2005

Well it is more exciting

# ? Aug 2, 2010 20:34

shrughes: Oct 11, 2008; (call/cc call/cc)

They'll need a bigint class for that, they could implement it as a char array, they'll just have to implement integer comparison.

# ? Aug 2, 2010 21:35

trex eaterofcadrs: Jun 17, 2005; My lack of understanding is only exceeded by my lack of concern.

Our e-commerce app allows people to delete their order record information out of the table, just a click of a mouse away and "DELETE FROM ORDER WHERE id=?" gets run. It's not archived anywhere or anything. I just had to piece together a guy's cart from weblogs.

# ? Aug 2, 2010 21:39

Vanadium: Jan 8, 2005

shrughes posted:

They'll need a bigint class for that, they could implement it as a char array, they'll just have to implement integer comparison.

Luckily, we already have a function for that, or so goes the intuitionistic introduction to recursion.

# ? Aug 2, 2010 21:44

pseudorandom name: May 6, 2007

code:

/*
 * Copyright (C) 2008 The Android Open Source Project
 * All rights reserved.

...

int strcmp(const char *a, const char *b)
{
    while(*a && *b) {
        if(*a++ != *b++) return 1;
    }
    if(*a || *b) return 1;
    return 0;
}

# ? Aug 2, 2010 23:37

Mustach: Mar 2, 2003; In this long line, there's been some real strange genes. You've got 'em all, with some extras thrown in.

Hmm, there seems to be a case missing�

# ? Aug 2, 2010 23:58

POKEMAN SAM: Jul 8, 2004

Mustach posted:

Hmm, there seems to be a case missing�

What case is missing? Obviously you can't sort with this, since it returns 0 or 1 instead of -1, 0, 1, but other than that what's wrong?

# ? Aug 3, 2010 00:39

A A 2 3 5 8 K: Nov 24, 2003; Illiteracy... what does that word even mean?

Ugg boots posted:

What case is missing?

FileNotFound

# ? Aug 3, 2010 00:45

Mustach: Mar 2, 2003; In this long line, there's been some real strange genes. You've got 'em all, with some extras thrown in.

A A 2 3 5 8 K posted:

FileNotFound

That's the one

# ? Aug 3, 2010 01:01

pseudorandom name: May 6, 2007

Granted, it's for the boot loader, and only ever used for equality, but why call it strcmp and use strcmp's inverted return convention? And then why not go the extra tiny step further and actually implement strcmp?

# ? Aug 3, 2010 02:36

zero knowledge: Apr 27, 2008

The real horror is using strcmp in the first place. strncmp is far safer.

HFX posted:

How is this any better then doing a comparison returning -1, 0, 1 on first difference unless I'm using something special that allows me to roll that up in one instruction?

Comparison functions shouldn't return on first difference to avoid timing attacks on password comparison.

# ? Aug 3, 2010 04:38

Wheany: Mar 17, 2006; Spinya^{ha^{ha^haha}ha}ha_{ha_{ha_haha}ha}ha!; Doctor Rope

Spazmo posted:

Comparison functions shouldn't return on first difference to avoid timing attacks on password comparison.

You shoudn't store plaintext passwords anyway?

# ? Aug 3, 2010 05:12

TOO SCSI FOR MY CAT: Oct 12, 2008; this is what happens when you take UI design away from engineers and give it to a bunch of hipster art student "designers"

pseudorandom name posted:

Granted, it's for the boot loader, and only ever used for equality, but why call it strcmp and use strcmp's inverted return convention? And then why not go the extra tiny step further and actually implement strcmp?

It was the default implementation of strcmp() for a generic platform, which was never used because more specific implementations were available for every supported architecture.

It actually is buggy, but this was not discovered until somebody examined the source code because it was never compiled.

# ? Aug 3, 2010 05:37

Shumagorath: Jun 6, 2001

pseudorandom name posted:

code:

/*
 * Copyright (C) 2008 The Android Open Source Project
 * All rights reserved.

...

int strcmp(const char *a, const char *b)
{
    while(*a && *b) {
        if(*a++ != *b++) return 1;
    }
    if(*a || *b) return 1;
    return 0;
}

How much of this is useful pointer math and how much would be compiled to the exact same thing if written much clearer? Maybe it's late and just a bad time to do pointer arithmetic.

# ? Aug 3, 2010 05:53

OddObserver: Apr 3, 2009

Spazmo posted:

Comparison functions shouldn't return on first difference to avoid timing attacks on password comparison.

Reminds me of a hilarious attack vector mentioned in:
Butler Lampson's "Hints for computer system design" --- http://research.microsoft.com/en-us/um/people/blampson/33-Hints/Acrobat.pdf --- see at page 5, starting from "Another example".

# ? Aug 3, 2010 05:56

HFX: Nov 29, 2004

Wheany posted:

You shoudn't store plaintext passwords anyway?

You shouldn't store passwords in plaintext or non salted non block level password schemes. Anyway who cares.

HFX fucked around with this message at 07:55 on Aug 3, 2010

# ? Aug 3, 2010 07:52

mjau: Aug 8, 2008

Spazmo posted:

The real horror is using strcmp in the first place. strncmp is far safer.

If you know that at least one of the strings are valid (eg it's a string constant), strcmp is just as safe as strncmp.

# ? Aug 3, 2010 08:46

Plorkyeran: Mar 22, 2007; To Escape The Shackles Of The Old Forums, We Must Reject The Tribal Negativity He Endorsed

Shumagorath posted:

How much of this is useful pointer math and how much would be compiled to the exact same thing if written much clearer? Maybe it's late and just a bad time to do pointer arithmetic.

That's already perfectly readable.

# ? Aug 3, 2010 09:16

rjmccall: Sep 7, 2007; no worries friend; Fun Shoe

mjau posted:

If you know that at least one of the strings are valid (eg it's a string constant), strcmp is just as safe as strncmp.

Both strings need to be valid unless (1) you are guaranteed that the possibly-invalid string, if invalid, has at least as many meaningful characters as the valid one or (2) you don't mind reading past the end of a string and either getting garbage results or crashing.

Also, there are very few excuses in this day and age to be using a string representation that doesn't pass around the string length.

# ? Aug 3, 2010 09:41

mjau: Aug 8, 2008

rjmccall posted:

Both strings need to be valid unless (1) you are guaranteed that the possibly-invalid string, if invalid, has at least as many meaningful characters as the valid one or (2) you don't mind reading past the end of a string and either getting garbage results or crashing.

Well, sure, but strncmp won't help you there. If you just compare against a prefix of the known valid string, you'll get invalid results.

quote:

Also, there are very few excuses in this day and age to be using a string representation that doesn't pass around the string length.

Yeah, but unfortunately that's not built into the language.

# ? Aug 3, 2010 10:48

Wheany: Mar 17, 2006; Spinya^{ha^{ha^haha}ha}ha_{ha_{ha_haha}ha}ha!; Doctor Rope

HFX posted:

You shouldn't store passwords in plaintext or non salted non block level password schemes. Anyway who cares.

Well I care in the sense that if your password system would be vulnerable to strcmp timing attacks, you are already doing it wrong.

I just wasn't sure if I missed a joke

# ? Aug 3, 2010 11:02

king_kilr: May 25, 2007

Spazmo posted:

The real horror is using strcmp in the first place. strncmp is far safer.

Comparison functions shouldn't return on first difference to avoid timing attacks on password comparison.

... your default comparison function doesn't need to be written for cryptographic security, you have a special function to do that. You think the default strcmp should iterate over my 1 million char string just for funsies?

And it further has dick-all to do with passwords, passwords should be hashed, it's for tokens and other such things that *are* plaintext.

# ? Aug 3, 2010 12:46

HFX: Nov 29, 2004

Wheany posted:

Well I care in the sense that if your password system would be vulnerable to strcmp timing attacks, you are already doing it wrong.

I just wasn't sure if I missed a joke

No you were doing it right. I was just adding onto what you say. Fundamentally, if you are using a scheme that is somehow broken by knowing the key length, you have bigger issues. Seriously, comparing full length is A level stupid especially when considering running on embedded platforms.

Then again, you would not believe how many people I've met who store passwords in plain text in databases. Apparently using a MD5, SHA-X library is too hard to locate and find for such popular languages as C, Java, C#, etc.

king_kilr posted:

... your default comparison function doesn't need to be written for cryptographic security, you have a special function to do that. You think the default strcmp should iterate over my 1 million char string just for funsies?

And it further has dick-all to do with passwords, passwords should be hashed, it's for tokens and other such things that *are* plaintext.

Thank you.

HFX fucked around with this message at 16:29 on Aug 3, 2010

# ? Aug 3, 2010 16:22

Lonely Wolf: Jan 20, 2003; Will hawk false idols for heaps and heaps of dough.

HFX posted:

Then again, you would not believe how many people I've met who store passwords in plain text in databases. Apparently using a MD5, SHA-X library is too hard to locate and find for such popular languages as C, Java, C#, etc.

Uh, why should I learn some esoteric library that'll make my life miserable when I'm just going to write the password on a sticky under my keyboard? :downs:

# ? Aug 3, 2010 16:48

Rohaq: Aug 11, 2006

I'm not sure if this is a horror, but I'm pretty sure this is some redundant code here:

code:

foreach $Attribute ('attr1','attr2','attr3') {
  if ($Attribute{$Attribute}) {
    print "<tr valign=top><td>",&PrintAttrLabel($Attribute),
          "<td>",&PrintAttr($Attribute,"_new"),"\n";
  }
}

Why? This is Perl: $Attribute is a return from a hardcoded flat list of string values. $Attribute{$Attribute} is treating it like a hash. What happens if you attempt to check the value of an array element like a hash using the string it already contains as the key?

It returns as true. Every time. It's an if statement that is always going to be inherently true :psyduck:

# ? Aug 3, 2010 17:50

Zombywuf: Mar 29, 2008

Rohaq posted:

Why? This is Perl: $Attribute is a return from a hardcoded flat list of string values. $Attribute{$Attribute} is treating it like a hash. What happens if you attempt to check the value of an array element like a hash using the string it already contains as the key?

It returns as true. Every time. It's an if statement that is always going to be inherently true

Er, no.

$Attribute refers to the scalar variable $Attribute. $Attribute{$Attribute} refers to the member of %Attribute (a completely different variable) indexed by the scalar stored in $Attribute.

# ? Aug 3, 2010 18:05

Rohaq: Aug 11, 2006

Zombywuf posted:

Er, no.

$Attribute refers to the scalar variable $Attribute. $Attribute{$Attribute} refers to the member of %Attribute (a completely different variable) indexed by the scalar stored in $Attribute.

I'll check this when I'm in work on Thursday, thanks for the info. Gotta love confusing variable names; especially useful right in the middle of tens of thousands of lines of code.

# ? Aug 3, 2010 19:19

rjmccall: Sep 7, 2007; no worries friend; Fun Shoe

mjau posted:

Well, sure, but strncmp won't help you there. If you just compare against a prefix of the known valid string, you'll get invalid results.

Well, we're talking about strncmp and fixed-size buffers here. Using a single call to strncmp to determine semantic equality only works if you're limiting the number of characters of precision anyway. Otherwise, you need some sort of fallback if strncmp returns equal and one of the strings is longer than a single buffer.

# ? Aug 3, 2010 19:48

Opinion Haver: Apr 9, 2007

Rohaq posted:

I'm not sure if this is a horror, but I'm pretty sure this is some redundant code here:
code:
foreach $Attribute ('attr1','attr2','attr3') {
  if ($Attribute{$Attribute}) {
    print "<tr valign=top><td>",&PrintAttrLabel($Attribute),
          "<td>",&PrintAttr($Attribute,"_new"),"\n";
  }
}
Why? This is Perl: $Attribute is a return from a hardcoded flat list of string values. $Attribute{$Attribute} is treating it like a hash. What happens if you attempt to check the value of an array element like a hash using the string it already contains as the key?

It returns as true. Every time. It's an if statement that is always going to be inherently true

Also you haven't needed to use & to call functions since Perl 4. Please say you're not using Perl 4.

# ? Aug 3, 2010 20:18

Blotto Skorzany: Nov 7, 2008; He's a PSoC, loose and runnin'
came the whisper from each lip
And he's here to do some business with
the bad ADC on his chip
bad ADC on his chiiiiip

Rohaq posted:

I'm not sure if this is a horror, but I'm pretty sure this is some redundant code here:
code:
foreach $Attribute ('attr1','attr2','attr3') {
  if ($Attribute{$Attribute}) {
    print "<tr valign=top><td>",&PrintAttrLabel($Attribute),
          "<td>",&PrintAttr($Attribute,"_new"),"\n";
  }
}
Why? This is Perl: $Attribute is a return from a hardcoded flat list of string values. $Attribute{$Attribute} is treating it like a hash. What happens if you attempt to check the value of an array element like a hash using the string it already contains as the key?

It returns as true. Every time. It's an if statement that is always going to be inherently true

loving murder whoever wrote this for not knowing what a template is anyways

# ? Aug 3, 2010 20:20

Dijkstracula: Mar 18, 2003; You can't spell 'vector field' without me, Professor!

yaoi prophet posted:

Also you haven't needed to use & to call functions since Perl 4. Please say you're not using Perl 4.

Technically, if you're omitting the parentheses to the function call (because TMTOWTDI), you have to include the & if the function call precedes its declaration.

edit: it only errors out if you're using use strict; without it, it doesn't do anything at all

Dijkstracula fucked around with this message at 20:30 on Aug 3, 2010

# ? Aug 3, 2010 20:28

Opinion Haver: Apr 9, 2007

Dijkstracula posted:

Technically, if you're omitting the parentheses to the function call (because TMTOWTDI), you have to include the & if the function call precedes its declaration.

edit: it only errors out if you're using use strict; without it, it doesn't do anything at all

code:

&foo 2;
foo 2;
sub foo { print @_; }


String found where operator expected at wtf.pl line 1, near "&foo "2""
	(Missing operator before  "2"?)
String found where operator expected at wtf.pl line 2, near "foo "2""
	(Do you need to predeclare foo?)
syntax error at wtf.pl line 1, near "&foo "2""
Execution of wtf.pl aborted due to compilation errors.

# ? Aug 3, 2010 20:35

shrughes: Oct 11, 2008; (call/cc call/cc)

HFX posted:

Then again, you would not believe how many people I've met who store passwords in plain text in databases. Apparently using a MD5, SHA-X library is too hard to locate and find for such popular languages as C, Java, C#, etc.

And MD5, or SHA-X, would be the wrong things to use.

# ? Aug 3, 2010 23:53

Dijkstracula: Mar 18, 2003; You can't spell 'vector field' without me, Professor!

yaoi prophet posted:

code:

&foo 2;
foo 2;
sub foo { print @_; }


String found where operator expected at wtf.pl line 1, near "&foo "2""
	(Missing operator before  "2"?)
String found where operator expected at wtf.pl line 2, near "foo "2""
	(Do you need to predeclare foo?)
syntax error at wtf.pl line 1, near "&foo "2""
Execution of wtf.pl aborted due to compilation errors.

Ah, it seems to behave differently if it's a void function... what I did was

code:

tnathan@tnathan-desktop:~$ cat foo.pl 
foo;

sub foo {
    print "butts";
}
tnathan@tnathan-desktop:~$ perl foo.pl
tnathan@tnathan-desktop:~$ 
tnathan@tnathan-desktop:~$ perl -w foo.pl
Unquoted string "foo" may clash with future reserved word at foo.pl line 1.
Useless use of a constant in void context at foo.pl line 1.
tnathan@tnathan-desktop:~$

I guess the lack of arguments as well as parentheses makes it even more ambiguous :shobon:

Dijkstracula fucked around with this message at 01:51 on Aug 4, 2010

# ? Aug 4, 2010 01:46

POKEMAN SAM: Jul 8, 2004

shrughes posted:

And MD5, or SHA-X, would be the wrong things to use.

Back when the stock PHPBB (I think) installations used MD5 with no salt or anything for hashing passwords/session cookies I was administrating an underground hacking forum, and one of our rival forums realized that they can impersonate our users by using the same MD5 hash of that user from their database on our forums and then they'd have access as that user.

What'd I do to fix this?

MD5(MD5($password))

Also, I started keeping plaintext passwords in the database, too, so that when their members logged in to our forums we just had their password in plaintext, no middleman.

# ? Aug 4, 2010 01:47

Adbot: ADBOT LOVES YOU

# ? Jun 3, 2024 12:00

shrughes: Oct 11, 2008; (call/cc call/cc)

Ugg boots posted:

Back when the stock PHPBB (I think) installations used MD5 with no salt or anything for hashing passwords/session cookies I was administrating an underground hacking forum, and one of our rival forums realized that they can impersonate our users by using the same MD5 hash of that user from their database on our forums and then they'd have access as that user.

What? Where did they find the "MD5 of your password" field?

# ? Aug 4, 2010 01:55

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Coding Horrors: You can gather all your technical debt into one easy framework!

«‹›1503 »