Coding Horrors: You can gather all your technical debt into one easy framework!

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Coding Horrors: You can gather all your technical debt into one easy framework!

«‹›1503 »

CPColin: Sep 9, 2003; Big ol' smile.

JavaScript code:

function sanitize2(text)
{
    text = text.replace(/&/g, 'and');
    text = text.replace(/\\/g, 'backslash');
    text = text.replace(/%/g, 'percent');
    text = text.replace(/\+/g, 'plus');
    text = text.replace(/"/g, 'dQuote');
    text = text.replace(/'/g, 'sQuote');
    text = text.replace(/\n/g, 'new line');
    text = text.replace(/\r/g, 'carriage return');
    text = text.replace(/</g, 'less than');
    text = text.replace(/>/g, 'greater than');
    text = text.replace(/\</g, 'less than');
    text = text.replace(/\>/g, 'greater than');
    return text;
}

I wonder what sanitize1 was :ohdear:

# ? Oct 9, 2018 22:24

Adbot: ADBOT LOVES YOU

# ? Jun 7, 2024 16:20

CPColin: Sep 9, 2003; Big ol' smile.

Double-postin':

XML code:

    <rewrite>
      <rules>
        <rule name="DebugTraceDumpBlockingRule" stopProcessing="true">
          <match url=".*" />
          <conditions>
            <add input="{QUERY_STRING}" pattern="^e=1$|^e=1&|(&e=1)" />
          </conditions>
          <action type="AbortRequest" />
        </rule>
      </rules>
    </rewrite>

You did it. You fixed the issue where anybody could add e=1 to your login page and see a dump of server info, including the key pair. Now the server just drops the connection. Good job fixing the issue via rewrite rules, instead of, say, disabling the debug dump. Good job also not announcing to your customers how trivially easy it was for people to steal your keys.

Oh, whoops, except you can still do e=%31 and see the dump anyway. Oh well.

# ? Oct 9, 2018 23:53

Taffer: Oct 15, 2010

Magissima posted:

What about for those of us not stuck in the Android ghetto?

Kotlin works anywhere Java works. Android is the main place it's used but far from the only place.

# ? Oct 10, 2018 00:27

hackbunny: Jul 22, 2007; I haven't been on SA for years but the person who gave me my previous av as a joke felt guilty for doing so and decided to get me a non-shitty av

TheresaJayne posted:

Each language has its place or it wouldnt have been created. (except that religious language and operating system - that is idiotic)

TempleOS and HolyC were created for noble and pure reasons, and I'm not being ironic in the least. They were created to be a modern home computer system in the vein of the Commodore 64, with all the creative freedom that came with them, and parts of their design are sheer genius. They were also created out of religious devotion: god told Terry to build him a temple, and he built him a temple in the only way he knew. Terry was insane and a douchebag, but he deserves mad respect for what he did and why

# ? Oct 10, 2018 00:28

Sereri: Sep 30, 2008; awwwrigami

CPColin posted:

JavaScript code:

function sanitize2(text)
{
    text = text.replace(/&/g, 'and');
    text = text.replace(/\\/g, 'backslash');
    text = text.replace(/%/g, 'percent');
    text = text.replace(/\+/g, 'plus');
    text = text.replace(/"/g, 'dQuote');
    text = text.replace(/'/g, 'sQuote');
    text = text.replace(/\n/g, 'new line');
    text = text.replace(/\r/g, 'carriage return');
    text = text.replace(/</g, 'less than');
    text = text.replace(/>/g, 'greater than');
    text = text.replace(/\</g, 'less than');
    text = text.replace(/\>/g, 'greater than');
    return text;
}

I wonder what sanitize1 was :ohdear:

Please don't post forums code

# ? Oct 10, 2018 16:27

CPColin: Sep 9, 2003; Big ol' smile.

Sereri posted:

Please don't post forums code

Sorry. How about this sequence of events:

Logs in and tries to access a page in the vendor's web application
Gets redirected to error.asp, which is a 404
Query string is ?errorno=900&errortext=User does not have access to the mask (WFFORM, Cookie=WFFORM=0).
Sets cookie value to WFFORM=1
Tries to access page again
Succeeds

I think this vendor isn't very good at this "security" stuff.

# ? Oct 10, 2018 17:36

Lumpy: Apr 26, 2002; La! La! La! Laaaa!; College Slice

CPColin posted:

Sorry. How about this sequence of events:

Logs in and tries to access a page in the vendor's web application

Gets redirected to error.asp, which is a 404

Query string is ?errorno=900&errortext=User does not have access to the mask (WFFORM, Cookie=WFFORM=0).

Sets cookie value to WFFORM=1

Tries to access page again

Succeeds

I think this vendor isn't very good at this "security" stuff.

I guess they could have shown you the page anyway when WFFORM was zero, so it could have been worse....

# ? Oct 10, 2018 18:40

redleader: Aug 18, 2005; Engage according to operational parameters

CPColin posted:

I think this vendor isn't very good at this "security" stuff.

Is this a vendor you could dump?

# ? Oct 10, 2018 20:21

CPColin: Sep 9, 2003; Big ol' smile.

redleader posted:

Is this a vendor you could dump?

I wish!

# ? Oct 10, 2018 20:28

pokeyman: Nov 26, 2006; That elephant ate my entire platoon.

node.js would silently stop calling setTimeout or setInterval callbacks once your app hit 25 days' uptime.

Choice maintainer comments:

quote:

For what it's worth you are not supposed to rely on timers staying running for a month.

Uh huh.

quote:

Note that what I meant by that isn't that your services aren't expected to be up for a month. It's that redundancy is expected (2+ instances behind a load balancer) so servers are resilient to failure.

Right, the fix is to have two node instances up for 25+ days so they can take turns not calling their callbacks.

# ? Oct 10, 2018 23:25

Master_Odin: Apr 15, 2010; My spear never misses its mark...

ladies

pokeyman posted:

Right, the fix is to have two node instances up for 25+ days so they can take turns not calling their callbacks.

If you're not building all of your applications to act "at scale" no matter what the actual requirements are, you're not building for the future and should be fired immediately for your lack of vision.

# ? Oct 10, 2018 23:44

JawnV6: Jul 4, 2004; So hot ...

I'm trying to remember an old Ruby horror. It was a graphics manipulation library, someone noticed it performing poorly, the root cause was something like "per-pixel methods relied on the method failing to be found at every level of the hierarchy and hitting the one defined at the top level". Anyone recall what I'm talking about?

pokeyman posted:

Right, the fix is to have two node instances up for 25+ days so they can take turns not calling their callbacks.

I'm asking for backups and load balancers on everything. It's the only way to count out past a month you know!

# ? Oct 11, 2018 00:34

return0: Apr 11, 2007

To be fair, having a single server up continuously for a month without interruption is not ideal.

# ? Oct 11, 2018 07:27

QuarkJets: Sep 8, 2008

return0 posted:

To be fair, having a single server up continuously for a month without interruption is not ideal.

why not

# ? Oct 11, 2018 07:50

xtal: Jan 9, 2011; by Fluffdaddy

QuarkJets posted:

why not

The closest thing to a correct answer is kernel upgrades, but a lot of web developers will say that restarting your server periodically is the best solution to memory leaks.

# ? Oct 11, 2018 10:42

redleader: Aug 18, 2005; Engage according to operational parameters

Keeping a server running without a break for such a long period of time could violate local labour laws, and gives the server a chance to take a quick breather to gather their thoughts.

# ? Oct 11, 2018 12:32

Magissima: Apr 15, 2013; I'd like to introduce you to some of the most special of our rocks and minerals.; Soiled Meat

This website is available 9-5 Monday through Friday

# ? Oct 11, 2018 13:03

creatine: Jan 27, 2012

Magissima posted:

This website is available 9-5 Monday through Friday

Literally every government site that accepts payments.

If I make a payment at 6pm on Friday for student loans it doesn't post to my account until Tuesday or wednesday

# ? Oct 11, 2018 13:04

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

QuarkJets posted:

why not

If you're not deploying every two weeks you're not agile and therefore bad and wrong. Don't question the time period - it must be two weeks because that is the agile way.

creatine posted:

Literally every government site that accepts payments.

If I make a payment at 6pm on Friday for student loans it doesn't post to my account until Tuesday or wednesday

Balance reconciliation takes multiple business days because the bank can hold the money and earn penny shavings off of it for free and so has no incentive to make the process faster.

Munkeymon fucked around with this message at 13:35 on Oct 11, 2018

# ? Oct 11, 2018 13:32

bigmandan: Sep 11, 2001; lol internet; College Slice

Canada Revenue Agency login is only available 21 hours a day. They have maintenance daily from 3am to 6am est. Lame, I like managing my taxes at 4 am.

# ? Oct 11, 2018 15:53

return0: Apr 11, 2007

xtal posted:

The closest thing to a correct answer is kernel upgrades, but a lot of web developers will say that restarting your server periodically is the best solution to memory leaks.

We rolling replace hosts frequently in case any prior vulnerability caused that host to be owned as one plank of a defence in depth policy.

# ? Oct 11, 2018 17:26

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

return0 posted:

We rolling replace hosts frequently in case any prior vulnerability caused that host to be owned as one plank of a defence in depth policy.

Oh snap I like that idea :allears:

# ? Oct 11, 2018 18:06

xtal: Jan 9, 2011; by Fluffdaddy

Munkeymon posted:

Oh snap I like that idea

I like it too, and hadn't thought of it when I made my post. But I think it would also have hardly any impact in practice. The host would get immediately, automatically re-owned unless the reboot fixed the vulnerability, which is the time when you would do a manual reboot.

Since it would force the attacker to try again, it may be valuable for defense in depth if the cost is low enough, but it doesn't add any real security.

xtal fucked around with this message at 18:18 on Oct 11, 2018

# ? Oct 11, 2018 18:15

return0: Apr 11, 2007

Consider a hypothetical vulnerability, either in application code, kernel, etc., which owns a host and allows arbitrary fuckery, such that the fuckery survives a subsequent reboot and/or patch. It�s to mitigate this by reducing the scope of the impact by replacing the host. It�s not a silver bullet, but I think it�s a worthwhile and cheap addition to the defence.

# ? Oct 11, 2018 18:53

Ola: Jul 19, 2004

Does replacing the host simply entail wiping and reinstalling? If you reinstall the same vulnerability, the attacker can just repeat it. But if you replace as part of an update after a vulnerability fix, you also close any backdoors or similar left after the vulnerability first provided access.

# ? Oct 11, 2018 19:39

return0: Apr 11, 2007

Replacing in this context refers to taking a host out of the load balancer and returning it to our cloud provider while simultaneously provisioning and bootstrapping a new host, and adding it to the load balancer.

# ? Oct 11, 2018 20:37

Scaramouche: Mar 26, 2001; SPACE FACE! SPACE FACE!

Co worker asked me to look at an SQL query that was returning odd results for him. It's selecting a series of values from a historic table, where he wants only the most recent value. I'm actually kind of amazed it nearly worked:

code:

SELECT
 (tonnes of stuff)
FROM
 (tonnes of joins)
WHERE
  CreateDate IN(select MAX(CreateDate) from HistoryTable Where HistoryID=JoinTableAbove.HistoryID Group By CreateDate)

For the non sql users this is a bad idea; what if two CreateDates are identical? What if CreateDate is NULL? The weird thing is that it mostly worked. The weirder thing is HistoryTable has synthetic incrementing IDs anyway, so the highest value will always be the most current.

# ? Oct 11, 2018 20:44

Jaded Burnout: Jul 10, 2004

1. gently caress off

2. gently caress offffffff

# ? Oct 12, 2018 11:13

AstuteCat: May 4, 2007

Jaded Burnout posted:

1. gently caress off

2. gently caress offffffff

I'm going to bet that this is the product of someone who learned to code at university while doing a thesis of some kind.

I'll also bet that they claim that they understand it just fine...

# ? Oct 12, 2018 11:27

Jaded Burnout: Jul 10, 2004

AstuteCat posted:

I'm going to bet that this is the product of someone who learned to code at university while doing a thesis of some kind.

I'll also bet that they claim that they understand it just fine...

I found the culprit for the copy/paste block of garbage single-letter variables. Of course *some* people think it's good code..
https://stackoverflow.com/questions/149055/how-can-i-format-numbers-as-dollars-currency-string-in-javascript/149099#149099

# ? Oct 12, 2018 12:14

Hammerite: Mar 9, 2007; And you don't remember what I said here, either, but it was pompous and stupid.; Jade Ear Joe

Jaded Burnout posted:

2. gently caress offffffff

IMO you should change the variable names so that they spell out "gently caress this"

# ? Oct 12, 2018 13:58

Slimy Hog: Apr 22, 2008

Jaded Burnout posted:

I found the culprit for the copy/paste block of garbage single-letter variables. Of course *some* people think it's good code..
https://stackoverflow.com/questions/149055/how-can-i-format-numbers-as-dollars-currency-string-in-javascript/149099#149099

A choice quote:

Someone who probably calls themselves a 'rockstar' un-ironically posted:

Wow, sure the code may not be the prettiest, but if you're worth your salt as a 'programmer', it is definitely not overly complicated or undecipherable, assuming you know how to read code, that is.

# ? Oct 12, 2018 14:31

canis minor: May 4, 2011

Hammerite posted:

IMO you should change the variable names so that they spell out "gently caress this"

And it's half way there already!

# ? Oct 12, 2018 14:36

LOOK I AM A TURTLE: May 22, 2003; "I'm actually a tortoise."; Grimey Drawer

The best part of that SO post is the guy in the comments who chose to focus on the use of x == undefined instead of typeof(x) === 'undefined'.

# ? Oct 12, 2018 14:36

Khorne: May 1, 2002

Jaded Burnout posted:

I found the culprit for the copy/paste block of garbage single-letter variables. Of course *some* people think it's good code..
https://stackoverflow.com/questions/149055/how-can-i-format-numbers-as-dollars-currency-string-in-javascript/149099#149099

If you find yourself assigning a variable to itself within the function-wide definition of that variable for a variable that's already defined in the function's scope you're probably beyond hope. This seems like one of those vertical alignment motivated coding horrors except there's so much more to it.

Also, you all missed the real obvious significance of these single letter variable names:

c = "count of significant figures after the decimal point"
d = decimal point
t = triple digit separator
s = sign
i = I gave up trying to think of how to describe this
j = justify using a triple digit separator

Khorne fucked around with this message at 15:50 on Oct 12, 2018

# ? Oct 12, 2018 15:47

Jaded Burnout: Jul 10, 2004

Khorne posted:

Also, you all missed the real obvious significance of these single letter variable names:

c = "count of significant figures after the decimal point"
d = decimal point
t = triple digit separator
s = sign
i = I gave up trying to think of how to describe this
j = justify using a triple digit separator

I actually wound up digging this up because I needed to find someone who had translated them. `t` could also be "thousands" and `s` is presumably "symbol".

The whole thing needs replacing but I just removed half the configuration since we were only ever passing in `0` as `c` and everything else stayed default.

# ? Oct 12, 2018 16:02

Doom Mathematic: Sep 2, 2008

Jaded Burnout posted:

I found the culprit for the copy/paste block of garbage single-letter variables. Of course *some* people think it's good code..
https://stackoverflow.com/questions/149055/how-can-i-format-numbers-as-dollars-currency-string-in-javascript/149099#149099

Someone's spent too long reading minified code and thinks it's actual code.

LOOK I AM A TURTLE posted:

The best part of that SO post is the guy in the comments who chose to focus on the use of x == undefined instead of typeof(x) === 'undefined'.

But what if x is null??

# ? Oct 12, 2018 17:31

Jaded Burnout: Jul 10, 2004

Doom Mathematic posted:

But what if x is null??

Ah, a nihilist

# ? Oct 12, 2018 18:15

Tarezax: Sep 12, 2009; MORT cancels dance: interrupted by MORT

Jaded Burnout posted:

I actually wound up digging this up because I needed to find someone who had translated them. `t` could also be "thousands" and `s` is presumably "symbol".

The whole thing needs replacing but I just removed half the configuration since we were only ever passing in `0` as `c` and everything else stayed default.

Also it doesn't cover east asian numbering systems, which divide on ten thousands for culturo-linguistic reasons

# ? Oct 12, 2018 20:41

Adbot: ADBOT LOVES YOU

# ? Jun 7, 2024 16:20

bob dobbs is dead: Oct 8, 2017; I love peeps; Nap Ghost

Tarezax posted:

Also it doesn't cover east asian numbering systems, which divide on ten thousands for culturo-linguistic reasons

.... lakh, crore....

# ? Oct 12, 2018 20:54

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Coding Horrors: You can gather all your technical debt into one easy framework!

«‹›1503 »