Coding Horrors: You can gather all your technical debt into one easy framework!

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Coding Horrors: You can gather all your technical debt into one easy framework!

«‹›1503 »

Corla Plankun: May 8, 2007; improve the lives of everyone

How much of a hack do you have to be to have to use someone else's linear interpolation function?

If you didn't take intro to algebra you probably should not be coding games.

# ? Sep 25, 2014 15:09

Adbot: ADBOT LOVES YOU

# ? May 17, 2024 18:22

ErIog: Jul 11, 2001

Corla Plankun posted:

How much of a hack do you have to be to have to use someone else's linear interpolation function?

If you didn't take intro to algebra you probably should not be coding games.

Eh, basic functions like that are so commonly used that reinventing them for every project would just end up leading to lots of bugs from typos. You might as well say, "a library sort function? If you can't implement bubble sort on your own then you probably should not be coding anything."

Using a math library instead of rolling your own poo poo so you can stroke your coding penis does not qualify as a coding horror. Far more coding horrors stem from people trying to reinvent the wheel instead of making use of either the standard library or third party libraries.

# ? Sep 25, 2014 15:22

hobbesmaster: Jan 28, 2008

Corla Plankun posted:

How much of a hack do you have to be to have to use someone else's linear interpolation function?

I use std::swap, what do you think about that.

# ? Sep 25, 2014 15:24

Space Kablooey: May 6, 2009

hobbesmaster posted:

I use std::swap, what do you think about that.

Go back to algorithms 101 you scrub. :smuggo:

# ? Sep 25, 2014 15:28

Corla Plankun: May 8, 2007; improve the lives of everyone

It would literally take me less time to write it than it would to find a library. If you already have a library for it built in then go hog wild!

# ? Sep 25, 2014 15:50

HappyHippo: Nov 19, 2003; Do you have an Air Miles Card?

Jewel posted:

If you take a look at those equations, you can probably see something massively wrong straight away. They're all wrong.

But they weren't wrong? Messy, yes, but not really wrong.

The only thing I'd say was wrong with it was those unnecessary bounds checks at the start, but you didn't fix those.

# ? Sep 25, 2014 16:47

Athas: Aug 6, 2007; fuck that joker

Vanadium posted:

What does bash parse functions out of environment variables in the first place?

It's the only way to export shell functions to subshells. Well, I suppose you could also put them in a magic file somewhere, but you couldn't do something nice like using a proper IPC mechanism, because you do not control how your subshells are started (consider something like the -exec action to find(1)). At the end of the day, it comes down to parsing the functions as text, and the environment is really the only sensible place to put them if you want this feature.

The problem is not as much this dumb feature, as the fact that the feature (and its bugs) were forced upon people who ask for just /bin/sh, expecting just a POSIX shell. Now, on good Unices, /bin/sh is not going to be bash (it's dash on Ubuntu and I think Debian, and something similar on *BSDs), but CentOS/Red Hat seems afflicted.

Stupid operating systems.

# ? Sep 25, 2014 16:48

Zopotantor: Feb 24, 2013; ...und ist er drin dann lassen wir ihn niemals wieder raus...

Something I noticed today (typed in from memory so probably not 100% accurate):

code:

INT32 value = /* read from HW register which has 31 significant bits */;
INT32 value1 = (value << 1) >> 1;
INT32 value2 = (value & 0x40000000) ? (value | 0x80000000) : (value & 0x7fffffff);
return (value1 == value2) ? value1 : value2;

# ? Sep 25, 2014 16:50

HappyHippo: Nov 19, 2003; Do you have an Air Miles Card?

That return line is something else alright

# ? Sep 25, 2014 17:01

Jewel: May 2, 2009

Isn't that whole thing just

code:

INT32 value = /* read from HW register which has 31 significant bits */;
return (value & 0x40000000) ? (value | 0x80000000) : (value & 0x7fffffff);

Or did you mistype it?

# ? Sep 25, 2014 17:03

Zopotantor: Feb 24, 2013; ...und ist er drin dann lassen wir ihn niemals wieder raus...

Jewel posted:

Isn't that whole thing just

code:

INT32 value = /* read from HW register which has 31 significant bits */;
return (value & 0x40000000) ? (value | 0x80000000) : (value & 0x7fffffff);

Or did you mistype it?

It's supposed to be a sign extension from 31 to 32 bits, yes. But obviously the author didn't trust that the simple way to do it (shift left, then right) would work. As for the thought process (if any) that led to doing it twice, and to the utterly insane last expression - I have no idea.

_{_{The fun bit? There are probably some chips in your smartphone, and your car, that were tested using the software containing this beauty.}} :unsmigghh:

# ? Sep 25, 2014 17:17

Begby: Apr 7, 2005; Light saber? Check. Black boots? Check. Codpiece? Check. He's more machine than kid now.

Came here to vent....

Working with a third party XML API. When you submit XML booleans are in any of these formats

Yes : No
Y : N
1 : 0
True : False
TRUE : FALSE
On : Off

All are case sensitive, and the responses differ from the requests. All the documentation says for each field is something like, "Use this to indicate such and such", it doesn't tell you what to use for any of them. The only way to do it is trial and error on each and every one, oh yeah, if the value is wrong you don't get an error, it just ignores it and sets it to the default value, but nowhere in the docs does it say what the default value is, for some its true, others its false. I emailed them and they said to get a developer to respond its like $150 per hour with a half hour minimum and they won't talk to me, the questions have to come from my client via a scheduled phone call. Its like they went out of their way to make this as frustrating as possible.

Their constants are the same way. Some are camel case, some are all lower case, some are all caps, they don't list the values anywhere. gently caress YOU.

Shoot me now.

# ? Sep 25, 2014 17:28

karms: Jan 22, 2006; by Nyc_Tattoo; Yam Slacker

Jewel posted:

Also remember that in as1 the built-in xml parser was worse than one written in as. Slow as gently caress as1.

Anything from that era should be scrutinized carefully. As for the current js dudes copying as1: you're just now finding out that js developers aren't the smartest people on the block?

# ? Sep 25, 2014 17:47

Blotto Skorzany: Nov 7, 2008; He's a PSoC, loose and runnin'
came the whisper from each lip
And he's here to do some business with
the bad ADC on his chip
bad ADC on his chiiiiip

Zopotantor posted:

But obviously the author didn't trust that the simple way to do it (shift left, then right) would work.

Unless you compile with -O0 and can guarantee this will never change, this isn't an unreasonable fear. The rest is still comedy though (especially leaving in the line of code that they think won't work, heh).

# ? Sep 25, 2014 17:48

Scaramouche: Mar 26, 2001; SPACE FACE! SPACE FACE!

tef posted:

It's not bash related, it's just a high impact vuln coming out soon: I don't have any details beyond a) it's happening, and b) good luck with AWS this weekend

Yeah, here's a little bit of info on what Amazon is planning starting tomorrow:
http://www.theregister.co.uk/2014/09/25/amazon_readies_global_glory_reboot/

Bizarrely the comments have some useful info.

# ? Sep 25, 2014 18:55

necrotic: Aug 2, 2005; I owe my brother big time for this!

Scaramouche posted:

Yeah, here's a little bit of info on what Amazon is planning starting tomorrow:
http://www.theregister.co.uk/2014/09/25/amazon_readies_global_glory_reboot/

Bizarrely the comments have some useful info.

We're currently scaled up to almost double as they work through all of this

# ? Sep 25, 2014 19:17

QuarkJets: Sep 8, 2008

Corla Plankun posted:

How much of a hack do you have to be to have to use someone else's linear interpolation function?

If you didn't take intro to algebra you probably should not be coding games.

Yeah who needs LAPACK, I've taken linear algebra I'll just rewrite all of these libraries myself in something reasonable like Ruby or PhP

# ? Sep 25, 2014 19:46

Dr. Stab: Sep 12, 2010; 👨🏻‍⚕️🩺🔪🙀😱🙀

Corla Plankun posted:

It would literally take me less time to write it than it would to find a library. If you already have a library for it built in then go hog wild!

If you're making games and don't already have a library with lerp in it, what are you doing?

# ? Sep 25, 2014 20:13

fritz: Jul 26, 2003

QuarkJets posted:

Yeah who needs LAPACK, I've taken linear algebra I'll just rewrite all of these libraries myself in something reasonable like Ruby or PhP

That's certainly an interesting comparison.

# ? Sep 25, 2014 21:05

Marsol0: Jun 6, 2004; No avatar. I just saved you some load time. You're welcome.

So I'm a CJ dealing with a product escalation right now.

We have a data team that has created stored routines for MySQL, which they've been using for a while. Now we have a product that has started to use these routines, because they need the same kind of data. Turns out, in the event of an error the data team's routines force a mysql error in the form of making a select for an invalid column from a non-existent table. They neglected to tell the other team about this.

So there are three kinds of "values" that these things return:

The data they want
NULL
MySQL Error

So now there's a scramble and I probably have to stay late.

# ? Sep 25, 2014 21:33

Scaevolus: Apr 16, 2007

Buildbot posted:

Properties load speedup

For example, if most of your build properties are strings, you can gain an approx. 30% speedup if you put this snippet of code inside your master.cfg file:
Python code:
def speedup_json_loads():
    import json, re

    original_decode = json._default_decoder.decode
    my_regexp = re.compile(r'^\[\"([^"]*)\",\s+\"([^"]*)\"\]$')
    def decode_with_re(str, *args, **kw):
        m = my_regexp.match(str)
        try:
            return list(m.groups())
        except:
            return original_decode(str, *args, **kw)
    json._default_decoder.decode = decode_with_re

speedup_json_loads()

Buildbot Optimization

# ? Sep 25, 2014 22:22

HFX: Nov 29, 2004

Working on some code cleanup today, I found this.

code:

StringBuilder processedHeader = new StringBuilder();
if (unprocessedValue.length() > 6) {
	processedHeader.append(unprocessedValue.substring((unprocessedValue.length() - 6), unprocessedValue.length()));
} else {
	processedHeader.append(unprocessedValue);
}
final String finalHeaderValue = processedHeader.toString();

if (!this.isValidFormat(finalHeaderValue)) {
      throw new RuntimeException();
}

The isValidFormat right below it:

code:

private boolean isValidFormat(final String value) {
    return value.matches("\\d{6}");
}

How this code came to be

I implemented a validation routine to match the company specs that the value must always be exactly a 6 digit number. Another service that all communication to the outside has to pass through was supposed to send us the 6 digit number so we could check it against the one in the document. That other service uses LDAP as their backing data store which stores the BAC as an 11 or 17 digit number with zeros padded in front. They send this number directly to us without reducing it back to the agreed upon and company standards size. I fought against changing my code on the basis that the clients shouldn't be sanitizing the data sent from the service when the service is the one sending it wrong. Unfortunately, I was overruled for political reasons.

At the time that we found out about the problem, I was busy fixing my senior coworkers' multi-threading issues. Since I was busy with the multi-threading issues, one of the seniors decided he was going to work with the guy from the service and fix it. Rather then fixing the regular expression to match 6 digits prefixed by either 11 or 17 0's, he chose to do it that way. This is part of why my job makes me want to drink.

# ? Sep 26, 2014 15:48

canis minor: May 4, 2011

Jewel posted:

easings...

Having had to implement our own parametrized easings (because why not...) this is particularly interesting: http://greweb.me/2012/02/bezier-curve-based-easing-functions-from-concept-to-implementation/

# ? Sep 26, 2014 16:36

Jewel: May 2, 2009

eithedog posted:

Having had to implement our own parametrized easings (because why not...) this is particularly interesting: http://greweb.me/2012/02/bezier-curve-based-easing-functions-from-concept-to-implementation/

Yeah, I wrote my own C# easing library since then and it's super parameterised and generic and you can pass in your own bezier curve if you want to and it'll work great, so that's fun. I'm gonna be releasing on github in a day or two so check it out. It doesn't have direct bezier support but it's so generic that it's no different to plug in a bezier than it is a predefined provided easing function.

Edit: Sneak edit to say I released it at http://github.com/Jewelots/Betwixt

There's more info in my post in the gamedev thread that I'm not gonna copypaste here.

Jewel fucked around with this message at 05:57 on Sep 27, 2014

# ? Sep 26, 2014 16:46

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

I don't think I've talked about this probable horror from my old job yet.

When the iPad came out we had to do some work to make the horrifying frame-using monstrosity that was (and still is!) the UI work. In the end, it worked about as well as it did on the desktop, which meant it was clunky and unforgivably slow for what it did, but whatever.

Then the apps came. Every site had to have an app because apps are the new thing and everyone loves apps because apps apps apps apps apps! Make the site not suck and pitch that to our clients? Nah, we have to have an app.

So someone made an app that was basically a webview with a set address and that got rejected because the reviewer saw it for what it was. The way around this was to staple a local file cache to the webview, apparently, because that's what we did.

The central horror came in during the setup process. There was a special touch sequence (basically an easter egg) in the app that would pop up an alert with a path in it which was, IIRC the path in the device filesystem that app lived in, and there was a hexed SHA or MD5 component of the path became part of the configuration to tell the file cache where to store stuff. The main reason the cookie-cutter copies of the app were rejected on first submission for a while was that the hash component of the path was transcribed wrong and whoever built it didn't bother to check to make sure it worked the second time they built it because that involved deploying it to the iPad, which involved mindless repetitive work in iTunes, which of course is painful and impossible to automate because iTunes.

Just to be clear, it'd go 1) configure and build Client.app 2) deploy to iPad* 3) use easter egg to get hash value 4) configure and build Client.app 5) deploy again* 6) check 7) submit to app store. No, the easter egg was not disabled in the submitted version. I checked.

Hundreds were made and it looks like ~4 of them are still in the store :lol:

I think I already mentioned the production environment, which was really the essence of :unsmigghh:

*_{optional: wish firey death upon the iTunes team and their entire families}

# ? Sep 26, 2014 19:48

Suspicious Dish: Sep 24, 2011; 2020 is the year of linux on the desktop, bro; Fun Shoe

KARMA! posted:

Also remember that in as1 the built-in xml parser was worse than one written in as. Slow as gently caress as1.

Anything from that era should be scrutinized carefully. As for the current js dudes copying as1: you're just now finding out that js developers aren't the smartest people on the block?

It's a home-rolled XML parser too, that implements quasi-XML with weird behavior like this "ignore whitespace" property: http://hg.mozilla.org/tamarin-redux/file/default/core/XMLParser16.cpp

Of course we have to reimplement it in Shumway and other Flash Players with 100% accuracy because real-world content depends on the quirks.

# ? Sep 27, 2014 07:45

Gazpacho: Jun 18, 2004; by Fluffdaddy; Slippery Tilde

Vanadium posted:

I think I get how people end up injecting environment variables, but who thought it would be a good idea to interpret random strings found at arbitrary places in the environment as functions at startup?

In my bashrc I have several interactive scripts that use "xargs bash -c" to run smaller scripts on each of a series of input records. In these smaller scripts, I have three options: I can use only plain old commands, or I can (re)define functions directly within them, or I can use the mechanism involved in this vulnerability to export functions from my interactive shell through xargs into the script.

I've been using the first two options because I didn't know about the function export mechanism, but if I had I'd be pretty heavily invested in it by now.

This feature of Bash is in the oldest available source code released in August 1996, and probably a few years older than that. That's back when people entrusted their passwords to telnet. The real horror is that the vulnerability of this plainly documented feature is only now being "discovered".

Gazpacho fucked around with this message at 09:57 on Sep 27, 2014

# ? Sep 27, 2014 09:45

Vanadium: Jan 8, 2005

Maybe the people who want to rewrite the entire userland to run on node.js somehow are on to something.

# ? Sep 27, 2014 10:18

Edison was a dick: Apr 3, 2010; direct current only

Gazpacho posted:

In my bashrc I have several interactive scripts that use "xargs bash -c" to run smaller scripts on each of a series of input records. In these smaller scripts, I have three options: I can use only plain old commands, or I can (re)define functions directly within them, or I can use the mechanism involved in this vulnerability to export functions from my interactive shell through xargs into the script.

I've been using the first two options because I didn't know about the function export mechanism, but if I had I'd be pretty heavily invested in it by now.

This feature of Bash is in the oldest available source code released in August 1996, and probably a few years older than that. That's back when people entrusted their passwords to telnet. The real horror is that the vulnerability of this plainly documented feature is only now being "discovered".

The issue isn't the idea of inheriting function definitions, it's the implementation. You're supposed to be exporting functions to the subshell with export -f.
The issue is that the code to do this was brain-dead, roughly equivalent to this:

code:

while read -d '' envvar; do
    varname=${envvar%%=*}
    varvalue=${envvar#*=}
    if printf %s "$varvalue" | grep -q '^() {'; then
        eval "$varname$varvalue"
    fi
done < <(env -0)

If they'd required that the variable name had to end with __func__, or if they'd exported a variable called __exported_functions__ which listed the variables to treat as functions, it would have cut down the vulnerability class from being able to set the value of any variable, to being able to inject arbitrary environment variables.

# ? Sep 27, 2014 11:54

pseudorandom name: May 6, 2007

Or if the legions of broken programs that pass an unsanitized attacker-controlled environment to bash didn't actually do something so idiotic...

# ? Sep 27, 2014 19:16

raminasi: Jan 25, 2005; a last drink with no ice

I am finding it teeth-grindingly annoying right now that you cannot define a MATLAB function inside a script file.

# ? Sep 27, 2014 20:14

Corla Plankun: May 8, 2007; improve the lives of everyone

I agree that it's annoying, but it is also a nice little "push" to get people to write complicated things as functions-with-subfunctions instead of weird monolithic scripts.

I have re-used a ton of things I've written because Matlab obliged me to write functions instead of scripts.

# ? Sep 27, 2014 21:00

Athas: Aug 6, 2007; fuck that joker

pseudorandom name posted:

Or if the legions of broken programs that pass an unsanitized attacker-controlled environment to bash didn't actually do something so idiotic...

They didn't. They passed an environment to /bin/sh, in which they knew that important shell variables (like PATH) were not tampered with. Bash pretends to be /bin/sh, but is not, resulting in this mess.

# ? Sep 27, 2014 21:20

Vanadium: Jan 8, 2005

Basically any bit of code needs to be prepared for any other code it might invoke directly or indirectly to take completely random data it can get somehow get its hands on and execute that data as trusted code in turn, or it's the first bit of code's fault.

Programs like web servers implementing CGI are in the wrong for trying to co-opt environment variables to pass information about the environment other invoked programs are running in, since everybody knows that without exception all environment variables exist to store shell scripts in for bash's benefit and need to be formatted/escaped/sanitized with bash's specific quirks in mind.

:confused:

# ? Sep 27, 2014 22:09

Polio Vax Scene: Apr 5, 2009

God drat I hate myself, just found something like this:

code:

void DoABunchOfStuff()
{
    //DoAVeryImportantFourthThing MUST BE RAN EVERY TIME
    DoFirstThing();

    DoSecondThing();

    bool doThirdThing = true;
    for (int i = 0; i < 5; i += 1)
    {
        if (!arbitraryCondition[i])
        {
            doThirdThing = false;
            return;
        }
    }
    if (doThirdThing)
    {
        DoAThirdThing();
    }

    DoAVeryImportantFourthThing();
}

If you can't see it, whoever wrote this used return instead of break and I spent way too long trying to figure out why DoAVeryImportantFourthThing wasn't being called. Yes, I moved the condition check into the method afterwards and changed it to use break. I suspect at one point DoAThirdThing was the last thing in this method and that's how it snuck by undetected for so long.

# ? Sep 29, 2014 20:54

Thermopyle: Jul 1, 2003; ...the stupid are cocksure while the intelligent are full of doubt. �Bertrand Russell

Manslaughter posted:

If you can't see it, whoever wrote this used return instead of break and I spent way too long trying to figure out why DoAVeryImportantFourthThing wasn't being called.

These are the worst problems to find.

# ? Sep 29, 2014 21:04

Knyteguy: Jul 6, 2005; YES to love
NO to shirts; Toilet Rascal

http://espn.go.com/blog/nfcwest/post/_/id/41811/how-to-identify-nfls-best-quarterbacks posted:

The late Don Smith never claimed his passer-rating formula was perfect.

Quite the opposite, in fact.

"Some people call it a quarterback rating system, but that really is not what it is," Smith told me during a 2002 interview. "It�s simply a passing statistic."

I've actually defended Smith's rating system because the quarterbacks with the highest ratings -- Tom Brady, Philip Rivers and Aaron Rodgers led the way last season -- usually are the best quarterbacks. But there's so much more to quarterbacking than passing stats for touchdowns, interceptions, attempts, completions and yardage.

Game situations should count for something, and now they do.

With input from football people, including ESPN analyst Trent Dilfer, our statistical analysts have developed a 100-point ratings scale for quarterbacks taking into account advanced stats, game situations and relevant non-passing stats, including fumbles and sacks, to evaluate quarterbacks far more thoroughly. The methodology is complex -- one of the formula's key algorithms spans some 10,000 lines -- but the resulting "Total Quarterback Rating" (QBR for short) beats the old passer rating in every conceivable fashion. The ratings scale will debut this season.

Bolding mine.

This would be a fun project. I don't know if any sort of calculation I could come up with would be able to beat a 10,000 line algorithm though :shrug:

# ? Sep 29, 2014 23:21

Scaramouche: Mar 26, 2001; SPACE FACE! SPACE FACE!

If player.lastname="manning" then pass.quality="rocket laser arm"

# ? Sep 29, 2014 23:30

SurgicalOntologist: Jun 17, 2004

I like that the 10,000 lines is one of the formula's algorithms.

# ? Sep 30, 2014 00:15

Adbot: ADBOT LOVES YOU

# ? May 17, 2024 18:22

JawnV6: Jul 4, 2004; So hot ...

Knyteguy posted:

Bolding mine.

This would be a fun project. I don't know if any sort of calculation I could come up with would be able to beat a 10,000 line algorithm though .

Imagine you've got a nontechnical superior asking you for the biggest semi-defensible LOC count you could come up with. Calling into a library? Include the library's wc -l count. Don't go gettin' fancy with some grep -c ';' nonsense, we want a big number.

# ? Sep 30, 2014 00:18

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Coding Horrors: You can gather all your technical debt into one easy framework!

«‹›1503 »