Coding Horrors: You can gather all your technical debt into one easy framework!

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Coding Horrors: You can gather all your technical debt into one easy framework!

«‹›1503 »

Zombywuf: Mar 29, 2008

uncleTomOfFinland posted:

In a way that has happened already.

If only anything ever used it, rfc822 is far more popular.

# ? Jan 8, 2012 15:14

Adbot: ADBOT LOVES YOU

# ? May 21, 2024 01:54

tef: May 30, 2004; -> some l-system crap ->

uncleTomOfFinland posted:

In a way that has happened already.

sup iso datetime format buddy :hf:

# ? Jan 9, 2012 17:13

TOO SCSI FOR MY CAT: Oct 12, 2008; this is what happens when you take UI design away from engineers and give it to a bunch of hipster art student "designers"

quote:

Patch-tag is now https safe, so you can access your projects with cryptographic security. Just use https style urls when interacting with patch-tag.

By the way � for you code shops with mission critical, high-value, national security endangering repos hosted at patch-tag � https isn�t completely safe.

You could, for instance, get your password sniffed by a man in the middle attack with arp poisoning, if you are in a public network like an internet cafe, or on a trusted network with a coworker who enjoys hanky panky.

There is a simple thing you can do to foil the terrorists though � just click outside the text fields and type some gibberish when you are entering your password.

Ha! Take that script kiddies!

# ? Jan 12, 2012 07:55

Zamujasa: Oct 27, 2010; Bread Liar

That quote reminds me of people who almost exhibit common sense, but make a sharp turn into a wall. For example, it really is possible to pull off a man-in-the-middle attack, but... not quite like the way he's showing.

The bit about trying to foil keyloggers is hilarious, though, and really comes out of nowhere as completely silly advice. :tinfoil:

# ? Jan 12, 2012 08:41

Zombywuf: Mar 29, 2008

Nicked from the daily wtf comments. A workaround for sometimes broken XML from a third party:

code:

Public Shared Sub LoadXMLFixed(doc As XmlDocument, text As String)

	Try

		doc.LoadXml(text)

	Catch

		doc.LoadXml(text.Replace("&","&amp;"))

	End Try

End Sub

# ? Jan 12, 2012 14:36

Impotence: Nov 8, 2010; Lipstick Apathy

Zamujasa posted:

That quote reminds me of people who almost exhibit common sense, but make a sharp turn into a wall. For example, it really is possible to pull off a man-in-the-middle attack, but... not quite like the way he's showing.

The bit about trying to foil keyloggers is hilarious, though, and really comes out of nowhere as completely silly advice.

Lol: L=Alto Palo

# ? Jan 12, 2012 15:28

bobthecheese: Jun 7, 2006; Although I've never met Martha Stewart, I'll probably never birth her child.

Zamujasa posted:

That quote reminds me of people who almost exhibit common sense, but make a sharp turn into a wall. For example, it really is possible to pull off a man-in-the-middle attack, but... not quite like the way he's showing.

The bit about trying to foil keyloggers is hilarious, though, and really comes out of nowhere as completely silly advice.

There's also the possibility that the author is giving that advice to give "security experts" who don't know what they're really talking about something to cling on to so that they'll allow employees to get their work done (so long as they type gibberish while typing in their password).

I mean, sometimes it's easier to throw them a stupid bone rather than ignoring them (even if the bone doesn't actually help things, so long as it doesn't harm things).

What's worse: having to type some gibberish while entering your password in an naive attempt at foiling key loggers, or not being able to use a tool for work because some jackass "security expert" has decided that SSL isn't secure enough?

bobthecheese fucked around with this message at 16:56 on Jan 12, 2012

# ? Jan 12, 2012 16:53

Crosscontaminant: Jan 18, 2007

Zombywuf posted:

A workaround for sometimes broken XML from a third party

You should probably specify you're catching an XmlException - naked catch blocks are discouraged in Python (which I'm familiar with) and I can't imagine the same not being true for Visual Basic.

# ? Jan 12, 2012 19:03

Scaevolus: Apr 16, 2007

Crosscontaminant posted:

You should probably specify you're catching an XmlException - naked catch blocks are discouraged in Python (which I'm familiar with) and I can't imagine the same not being true for Visual Basic.

Did you read the thread title?

# ? Jan 12, 2012 23:10

Large Hardon Collider: Nov 28, 2005; PARADOL EX FAN CLUB

The project I just signed on to work was developed using the Jenga method -- start with a stable Wordpress base, then bring on coder after coder to add new layers by pulling blocks out of the foundation.

code:

if($_GET['latlng']) :
  $latlng = str_replace('(','',$_GET['latlng']);
  $latlng = str_replace(')','',$latlng);
  $latlng_parts = explode(',',$latlng);
  $zip = $geoplugin->postalCode(trim($latlng_parts[0]),trim($latlng_parts[1]));
  header('Location: ' . str_replace($_SERVER['QUERY_STRING'],'',$_SERVER['REQUEST_URI']) . '?zip=' . $zip);
  exit;
elseif($_GET['zip']) :
  $zip = save_the_zip($_GET['zip'],true); 
  header('Location: ' . str_replace('?','',str_replace($_SERVER['QUERY_STRING'],'',$_SERVER['REQUEST_URI'])));
  exit;
endif;

I'm convinced these redirects are the web development version of the speed-up loop.

# ? Jan 13, 2012 00:24

Strong Sauce: Jul 2, 2003; You know I am not really your father.

While we're still talking about timezones...

https://www.eff.org/press/releases/eff-demands-withdrawal-bogus-time-zone-database-lawsuit

Large Hardon Collider posted:

I'm convinced these redirects are the web development version of the speed-up loop.

It took me a while to figure out they save the zip (to a cookie? session?) and then eliminate the query string. Or at least try to because he has too many parameters to str_replace.

# ? Jan 13, 2012 01:47

Hammerite: Mar 9, 2007; And you don't remember what I said here, either, but it was pompous and stupid.; Jade Ear Joe

Strong Sauce posted:

It took me a while to figure out they save the zip (to a cookie? session?) and then eliminate the query string. Or at least try to because he has too many parameters to str_replace.

It appears to pass the correct number of arguments to str_replace()?

The inefficiency of it comes because it redirects them unnecessarily. If they submit the GET variable 'zip' then a cookie is saved, then they get redirected. If they submit the GET variable 'latlng' they get redirected, then a cookie is saved, then they get redirected a second time. All of these redirects would appear to be unnecessary.

# ? Jan 13, 2012 06:14

Strong Sauce: Jul 2, 2003; You know I am not really your father.

Hammerite posted:

It appears to pass the correct number of arguments to str_replace()?

The inefficiency of it comes because it redirects them unnecessarily. If they submit the GET variable 'zip' then a cookie is saved, then they get redirected. If they submit the GET variable 'latlng' they get redirected, then a cookie is saved, then they get redirected a second time. All of these redirects would appear to be unnecessary.

You're right I missed the nested str_replace in there.

I knew it was doing extra redirects. While I could see why he would redirect a lat/long query to one that redirected to whatever zipcode it was, that became irrelevant when he just redirected the zipcode after saving it into a cookie or session.

So essentially what you just said...

# ? Jan 13, 2012 06:28

Crosscontaminant: Jan 18, 2007

Scaevolus posted:

Did you read the thread title?

Yes, but I thought that was related to a recent WTF about a customer refusing to escape their own ampersands and not supposed to be a WTF in itself.

# ? Jan 13, 2012 06:58

kalleth: Jan 28, 2006; C'mon, just give it a shot; Fun Shoe

code:

  def configure_license_pack
    threaded do
      # do nothing yet apart from have a short snooze for effect ;-)
      sleep 3
      send_event(:configured)
    end
  end

Added as a placeholder because "licensing will be implemented in about 2 months".

This was committed to SVN four years ago.

# ? Jan 13, 2012 11:28

bobthecheese: Jun 7, 2006; Although I've never met Martha Stewart, I'll probably never birth her child.

php:

<?
function ClearMSSQLResultSet($rs) {
    while (odbc_fetch_array($rs)) { /* Do nothing */ }
}
?>

I can't believe that I just had to implement that.

Apparently, on certain 'free' ODBC drivers, you can't open a new result set (i.e. execute a new query) unless the previous result set has been spooled entirely to the end.

#EDIT: turns out that I don't need to do this after all. odbc_free_result() does the job.

bobthecheese fucked around with this message at 18:31 on Jan 13, 2012

# ? Jan 13, 2012 17:26

Bruegels Fuckbooks: Sep 14, 2004; Now, listen - I know the two of you are very different from each other in a lot of ways, but you have to understand that as far as Grandpa's concerned, you're both pieces of shit! Yeah. I can prove it mathematically.

Crosscontaminant posted:

Yes, but I thought that was related to a recent WTF about a customer refusing to escape their own ampersands and not supposed to be a WTF in itself.

Think about it this way: what happens if the XML passed in already has an escaped character in it?

# ? Jan 13, 2012 18:12

geonetix: Mar 6, 2011

bobthecheese posted:

php:
<?
function ClearMSSQLResultSet($rs) {
    while (odbc_fetch_array($rs)) { /* Do nothing */ }
}
?>
I can't believe that I just had to implement that.

Apparently, on certain 'free' ODBC drivers, you can't open a new result set (i.e. execute a new query) unless the previous result set has been spooled entirely to the end.

#EDIT: turns out that I don't need to do this after all. odbc_free_result() does the job.

I was thinking: does using cursors solve that? But that seems like overkill.

Then again, I went looking for odbc_free_result too, but only found the PHP method which - when I looked at the implementation of it - didn't actually seem to clear the resultset, but memory allocations per column. Then again, I'm a bad coder so I might have totally misread it in my haste.

# ? Jan 13, 2012 18:44

Suspicious Dish: Sep 24, 2011; 2020 is the year of linux on the desktop, bro; Fun Shoe

If people haven't written a polyglot yet, it's quite fun. Here's a Python and C polyglot I wrote a little bit earlier:

code:

#include <stdio.h>
#define exec(S)
#define semi(S) S;
#define close_brace }
#define if(C) if (C) b

#define def static int
#define def_factorial(A) factorial(int A) { a

exec("\n\
def printf(f, *a):\n\
    print (f % a).rstrip()\n\
\n\
def dummy(*a):\n\
    pass\n\
\n\
semi = main = dummy\n\
")

def def_factorial(N):
    if(N == 1):
        return 1;
    return factorial(N - 1) * N;
    close_brace
#if 0
factorial = def_factorial
#endif

main()
{
semi(printf("The factorial of 20 is %d!\n", factorial(5)))
}

It relies on Python 2.7, because I abuse the set syntax in there.

# ? Jan 15, 2012 05:27

Large Hardon Collider: Nov 28, 2005; PARADOL EX FAN CLUB

Oh good lord. The site was querying the google geocode service about 20 times per page load. Launched the site officially and it instantly maxed out the limit (2,500/day).

# ? Jan 15, 2012 07:14

The Gripper: Sep 14, 2004; i am winner

Large Hardon Collider posted:

Oh good lord. The site was querying the google geocode service about 20 times per page load. Launched the site officially and it instantly maxed out the limit (2,500/day).

Accidentally did this with the Twitter API once. Added some error-checking and retry requests for when the API was slow or not responding, but forgot to break out of the loop when there wasn't an error. Sucked a lot because testing it didn't reveal any problem (wasn't requesting enough to hit the rate limit solo), and the data returned was still correct even though it was making the same request a dozen times and throwing the first 11 iterations away. The API has slow moments anyway so I figured the speed was due to that.

Put it live, hit the rate limit in about 8 seconds. Luckily it's hourly and not daily.

code:

for (my $wait=2;$wait<=128;$wait*=2) {
    $statuses = eval {
        $nt->user_timeline($args);
    };
    if (my $error = $@) {
        if (blessed $error && $error->isa("Net::Twitter::Lite::Error")
             @@ $error->code() == 502) {
            print "502 error, retrying in $wait seconds.\n";
            sleep($wait);
            next;
        }
        warn $@;
        last;
    }
    last; <- rear end in a top hat
}
return $statuses;

# ? Jan 15, 2012 07:59

Zamujasa: Oct 27, 2010; Bread Liar

code:

[...]
	$8797  B9 A5 87:    lda _JumpPointerTable_107A5,y
	$879A  85 10:       sta $10
	$879C  B9 A6 87:    lda _JumpPointerTable_107A5+1,y
	$879F  85 11:       sta $11
	$87A1  6C 10 00:    jmp ($0010)
+	$87A4  60:          rts 
;------------------------------------------
_JumpPointerTable_107A5
	$87A5  A9 87:       .word (JumpTarget_107a9) ;87A9 (107A9) ()
	$87A7  A9 87:       .word (JumpTarget_107a9) ;87A9 (107A9) ()
JumpTarget_107a9
	$87A9  60:          rts

Is it just me, or is this basically :derp:

in assembly form? Why would you go through all that work just to jump to an RTS again?

# ? Jan 15, 2012 09:47

Jabor: Jul 16, 2010; #1 Loser at SpaceChem

Those look like direct-indexed accesses to me, not immediate ones. What's typically in the Y register at that point?

# ? Jan 15, 2012 12:13

ymgve: Jan 2, 2004; Offensive Clock

Zamujasa posted:

code:

[...]
	$8797  B9 A5 87:    lda _JumpPointerTable_107A5,y
	$879A  85 10:       sta $10
	$879C  B9 A6 87:    lda _JumpPointerTable_107A5+1,y
	$879F  85 11:       sta $11
	$87A1  6C 10 00:    jmp ($0010)
+	$87A4  60:          rts 
;------------------------------------------
_JumpPointerTable_107A5
	$87A5  A9 87:       .word (JumpTarget_107a9) ;87A9 (107A9) ()
	$87A7  A9 87:       .word (JumpTarget_107a9) ;87A9 (107A9) ()
JumpTarget_107a9
	$87A9  60:          rts

Is it just me, or is this basically :derp:

in assembly form? Why would you go through all that work just to jump to an RTS again?

Placeholders in the table? But still, why would you use a jump table for just two options?

# ? Jan 15, 2012 13:08

Zamujasa: Oct 27, 2010; Bread Liar

Jabor posted:

Those look like direct-indexed accesses to me, not immediate ones. What's typically in the Y register at that point?

Nothing out of the ordinary. This kind of code is repeated in multiple places (there are a lot of jump tables laying around for some reason) and this one just happens to be completely pointless, I guess.

My guess is that there were supposed to be other possible functions it'd jump to, but it looks like they either were never implemented or were replaced with a simple RTS. (Though why not just remove the whole thing instead of jumping around more?)

# ? Jan 15, 2012 14:41

OddObserver: Apr 3, 2009

This isn't a PLT thunk, is it?

# ? Jan 15, 2012 15:44

pseudorandom name: May 6, 2007

Not on the NES, no.

# ? Jan 15, 2012 18:45

Jabor: Jul 16, 2010; #1 Loser at SpaceChem

Zamujasa posted:

Nothing out of the ordinary. This kind of code is repeated in multiple places (there are a lot of jump tables laying around for some reason) and this one just happens to be completely pointless, I guess.

Unless the Y register is zero at that point, those two reads aren't actually retrieving $87A5 and $87A7.

In any case, if this is hand-rolled asm it's probably a potential expansion point - it's nontrivial to add a jump table in if it's not already there, but expanding a no-op jump table is fairly easy.

# ? Jan 16, 2012 00:17

Look Around You: Jan 19, 2009

Hoooly gently caress.

So after some discussion(starting there and going till the end of the thread right now) in the General Programming thread about why a guy had to put eval(input(prompt)) instead of input(prompt), I looked it up in the docs. Apparently in python 2.x (including the current version, 2.7.2), input() is is the same as eval(raw_input()). This was fixed for python 3.x but still holy poo poo. And the worst part is that pretty much every tutorial has you use input with it's implicit eval and even relying on it to convert the results without a second thought (and without even mentioning it).

I have no idea how they thought a built in function named input should automatically and implicitly do an eval on the raw stuff it gets. Like god drat.

# ? Jan 17, 2012 07:41

Jewel: May 2, 2009

Cross posting my post too.

# ? Jan 17, 2012 08:10

Beef: Jul 26, 2004

Doesn't Python have a read()? Didn't Guido learn anything from SICP ... oh wait, this is one of those examples why he should have, right?

# ? Jan 17, 2012 09:38

Crosscontaminant: Jan 18, 2007

The Python 2 way of reading user input from stdin is raw_input() which always returns a string. The Python 3 name for the same thing is input(). As I said over in the other thread I suspect the reason for the input() definition in Python 2 is some sort of compatibility between the two Pythons, but why it's specifically implemented as eval(raw_input()) is nothing but a WTF.

# ? Jan 17, 2012 17:49

xf86enodev: Mar 27, 2010; dis catte!

Python should finally catch up and release their docs on youtube!

Seriously, does no one read any documentation anymore? I mean you know that you don't know what a thing does but do it anyway. And then you bitch when something goes wrong? :iia:

# ? Jan 18, 2012 01:24

ToxicFrog: Apr 26, 2008

Crosscontaminant posted:

The Python 2 way of reading user input from stdin is raw_input() which always returns a string. The Python 3 name for the same thing is input(). As I said over in the other thread I suspect the reason for the input() definition in Python 2 is some sort of compatibility between the two Pythons, but why it's specifically implemented as eval(raw_input()) is nothing but a WTF.

It's implemented in Python 2 as eval(raw_input()) because that's how it worked in Python 1.

Why did it work like that in Python 1? :iiam:

I have no idea why this would ever be considered a good idea, especially given an innocuous name like input.

xf86enodev posted:

Seriously, does no one read any documentation anymore? I mean you know that you don't know what a thing does but do it anyway. And then you bitch when something goes wrong?

In this case, the bitch is that the documentation aimed at beginners says to use input(), without explaining what it actually does under the hood or why it might be dangerous.

# ? Jan 18, 2012 01:45

Look Around You: Jan 19, 2009

xf86enodev posted:

Python should finally catch up and release their docs on youtube!

Seriously, does no one read any documentation anymore? I mean you know that you don't know what a thing does but do it anyway. And then you bitch when something goes wrong?

I mean I could see that with more obscure api calls, but a function named input should probably be a safe way of getting input. And as was said, most documentation aimed at beginners says to use input, not raw_input. I just have no idea why they thought that a function just named input should eval what it gets implicitly. It's loving stupid.

# ? Jan 18, 2012 01:50

xf86enodev: Mar 27, 2010; dis catte!

Yup, there's lovely books out there but that's no coding horror.

Jewel posted:

I know a lot of people who used raw_input for strings and input for ints.

This is a coding horror. I mean, why would you do that? Are strings raw and ints are not? Whatever the reasoning, a look into the documentation (and I'm not talking about stackoverflow some or guy's blog) and this would be a none-issue.

# ? Jan 18, 2012 06:24

Jabor: Jul 16, 2010; #1 Loser at SpaceChem

Sorry, but input is right up there with mysql_escape_string as a complete horror of a function name given what it actually does.

Actually, the mere existence of a function which does that is a complete horror.

# ? Jan 18, 2012 06:34

LOOK I AM A TURTLE: May 22, 2003; "I'm actually a tortoise."; Grimey Drawer

Vaguely on the subject of "input" in Python: One time a coworker of mine wrote code that essentially did this:

code:

def awesome_function():
    if something():
        input = do_a_thing()

    ...

    if input:
        <code that always gets executed because input never evaluates to false>

# ? Jan 18, 2012 08:22

Toady: Jan 12, 2009

Has there ever been a published book of coding horrors and related mistakes of technology? Like a Darwin Awards of programming?

# ? Jan 18, 2012 08:57

Adbot: ADBOT LOVES YOU

# ? May 21, 2024 01:54

qntm: Jun 17, 2009

Jabor posted:

Sorry, but input is right up there with mysql_escape_string as a complete horror of a function name given what it actually does.

Actually, the mere existence of a function which does that is a complete horror.

You mean myqsl_real_escape_string(), of course.

# ? Jan 18, 2012 11:55

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Coding Horrors: You can gather all your technical debt into one easy framework!

«‹›1503 »