Coding Horrors: You can gather all your technical debt into one easy framework!

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Coding Horrors: You can gather all your technical debt into one easy framework!

«‹›1503 »

necrotic: Aug 2, 2005; I owe my brother big time for this!

pokeyman posted:

Leap years: embraced.
DST hours: contentious.
Leap seconds: hosed.

I do think the smear approach is pretty neat but lol at ever having to think about it or handle it myself

# ? Nov 11, 2022 01:42

Adbot: ADBOT LOVES YOU

# ? May 21, 2024 04:47

Jabor: Jul 16, 2010; #1 Loser at SpaceChem

Part of the reason the smear approach is so good is that nobody outside of the folks implementing it needs to care about it or even notice it at all.

# ? Nov 11, 2022 01:48

necrotic: Aug 2, 2005; I owe my brother big time for this!

Jabor posted:

Part of the reason the smear approach is so good is that nobody outside of the folks implementing it needs to care about it or even notice it at all.

Exactly!

# ? Nov 11, 2022 01:50

Beef: Jul 26, 2004

Until you find out that your code was breaking because someone was using a timestamp as a unique ID.

# ? Nov 11, 2022 09:14

Jabor: Jul 16, 2010; #1 Loser at SpaceChem

Beef posted:

Until you find out that your code was breaking because someone was using a timestamp as a unique ID.

Can you elaborate on this?

Part of the point of smearing is that you still get monotonically increasing time around the leap second without any rewinds or discontinuities, so I'm finding it hard to understand what you mean.

# ? Nov 11, 2022 10:09

Beef: Jul 26, 2004

Did not know that about smearing, my knowledge is out of date.

# ? Nov 11, 2022 10:21

ultrafilter: Aug 23, 2007; It's okay if you have any questions.

I did see a bug related to that where someone took a string representation of a timestamp and converted it to an integer without regard for overflow. The process was originally running on a big endian machine so it lost the year, but the time range was such that that didn't matter. When we moved it over to a little endian machine it started losing the second and all hell broke loose.

# ? Nov 11, 2022 15:16

Polio Vax Scene: Apr 5, 2009

Jabor posted:

Can you elaborate on this?

Part of the point of smearing is that you still get monotonically increasing time around the leap second without any rewinds or discontinuities, so I'm finding it hard to understand what you mean.

Can't speak for Beef, but one of our programs appends yyyyMMddHHmmss to the file name of files it creates, plus a random 3 digits at the end.
When asked about "what if the program creates two files at the same time and the rng spits out the same 3 digits both times?" I was told this is so statistically unlikely that we shouldn't worry about it :v:

# ? Nov 11, 2022 15:29

shame on an IGA: Apr 8, 2005

Polio Vax Scene posted:

Can't speak for Beef, but one of our programs appends yyyyMMddHHmmss to the file name of files it creates, plus a random 3 digits at the end.
When asked about "what if the program creates two files at the same time and the rng spits out the same 3 digits both times?" I was told this is so statistically unlikely that we shouldn't worry about it

I'm like "oh shoulda appended a whole GUID" and then got to digging and oh drat the RFC for those specifies a weird time format with a weird epoch

quote:

4.1.4. Timestamp

The timestamp is a 60-bit value. For UUID version 1, this is represented by Coordinated Universal Time (UTC) as a count of 100-nanosecond intervals since 00:00:00.00, 15 October 1582 (the date of Gregorian reform to the Christian calendar).

fuckin clock circles all the way down

# ? Nov 11, 2022 16:03

Ranzear: Jul 25, 2013

quote:

100-nanosecond intervals since 00:00:00.00, 15 October 1582

This poo poo is how lostech and 40k behaviors about technical systems come about.

# ? Nov 11, 2022 16:05

OddObserver: Apr 3, 2009

shame on an IGA posted:

I'm like "oh shoulda appended a whole GUID" and then got to digging and oh drat the RFC for those specifies a weird time format with a weird epoch

fuckin clock circles all the way down

....It's a little odd to call the Julian calendar "the Christian calendar"

# ? Nov 11, 2022 16:20

lifg: Dec 4, 2000; <this tag left blank>; Muldoon

Leap smear: Google nonsense

Edit: beaten

# ? Nov 11, 2022 16:33

Beef: Jul 26, 2004

Perhaps the horror we uncovered here is that smearing was introduced to as a bugfix for a Google-scale UUID collision on leap seconds.

# ? Nov 11, 2022 17:30

dougdrums: Feb 25, 2005; CLIENT REQUESTED ELECTRONIC FUNDING RECEIPT (FUNDS NOW)

I feel like uuids are dumb but I don�t have any real argument to go off of

# ? Nov 11, 2022 17:40

necrotic: Aug 2, 2005; I owe my brother big time for this!

Beef posted:

Until you find out that your code was breaking because someone was using a timestamp as a unique ID.

Regular clock skew corrections could cause this even if leap seconds didn�t exist.

# ? Nov 11, 2022 18:42

champagne posting: Apr 5, 2006; YOU ARE A BRAIN
IN A BUNKER

dougdrums posted:

I feel like uuids are dumb but I don�t have any real argument to go off of

Active Directory has a bunch and the Dumb of them is that different systems have different ways to identify A Thing to a Resource so that for one system you need to use a Service Principal Id while for another you'll be using an Application App Id even though you're referring to the same thing.

They should really stream line it or do something

# ? Nov 11, 2022 18:50

Vanadium: Jan 8, 2005

Are we talking about the UUIDs that are based on timestamps and encode a bunch of stuff or the ones that are just a whole lot of random bits?

# ? Nov 11, 2022 21:33

dougdrums: Feb 25, 2005; CLIENT REQUESTED ELECTRONIC FUNDING RECEIPT (FUNDS NOW)

Even uuid version 4 needs version and variant bits, so to be insanely pedantic you still need to validate it.

# ? Nov 11, 2022 22:51

Hammerite: Mar 9, 2007; And you don't remember what I said here, either, but it was pompous and stupid.; Jade Ear Joe

OddObserver posted:

....It's a little odd to call the Julian calendar "the Christian calendar"

I would suppose that when that text refers to "the Christian calendar", it is talking about the legally recognized calendar in those places where the Gregorian calendar was adopted in place of the Julian.

It talks of the "Gregorian reform to the... calendar". That reflects the fact that the calendar in official use changed from the Julian to the Gregorian. The Julian calendar itself wasn't reformed, just ceased to be the calendar in use. The Julian calendar still exists - in as much as an abstract concept like a way of tracking time can be said to "exist" - and you could use it now for tracking time, if you wanted to. It's not been "reformed", just abandoned. Since the Julian calendar wasn't "reformed" or changed, it cannot be the subject of the sentence.

# ? Nov 11, 2022 23:41

Carbon dioxide: Oct 9, 2012

Do Eastern Orthodox christians use a different calendar altogether or do they use Gregorian, just with the holidays shifted a week?

# ? Nov 12, 2022 08:02

cheetah7071: Oct 20, 2010; honk honk; College Slice

Carbon dioxide posted:

Do Eastern Orthodox christians use a different calendar altogether or do they use Gregorian, just with the holidays shifted a week?

my understanding is that they never switched from julian to gregorian. so their holidays are the same day they've always been in the julian calendar, which is now 13 days different from the gregorian calendar

# ? Nov 12, 2022 08:18

Volguus: Mar 3, 2009

Carbon dioxide posted:

Do Eastern Orthodox christians use a different calendar altogether or do they use Gregorian, just with the holidays shifted a week?

It depends. Romanian Orthodox church is using the normal Gregorian calendar, with Christmas on Dec 25th. The serbian Orthodox, use the Julian calendar, with christmas in January.

# ? Nov 12, 2022 17:09

biceps crimes: Apr 12, 2008

Does this seem like a bad idea to anyone else? https://github.com/rails/execjs

I deleted an npm package in node_modules. Our TypeScript all compiled fine, our thorough and extensive tests passed, etc. Deploy to prod and it breaks a random Rails model validator with an ENOENT at runtime because it was hardcoded to loving import a js file from a package's dist folder in node_modules and execute it using rails/execjs. This smells really bad to me, and the rails areas of this codebase are deprecated, but the guy who wrote it defended it as "idiomatic rails".

# ? Nov 13, 2022 18:09

dougdrums: Feb 25, 2005; CLIENT REQUESTED ELECTRONIC FUNDING RECEIPT (FUNDS NOW)

I�m pretty sure I�ve met people who are that repo personified

# ? Nov 13, 2022 18:10

Ralith: Jan 12, 2011; I see a ship in the harbor
I can and shall obey
But if it wasn't for your misfortune
I'd be a heavenly person today

dougdrums posted:

I feel like uuids are dumb but I don’t have any real argument to go off of

UUIDs in terms of the actual spec are really dumb because almost invariably any application that needs something like that uses it as an implementation detail, which means making public guarantees about its structure and semantics adds a bunch of completely pointless fragility compared to exposing only an opaque 128 bit (or whatever) value. The presence of specced UUIDs in a system is a sign that the designer is blindly implementing patterns without critically evaluating whether they're relevant, which is a real bad code smell.

A similar case of a spec in search of a problem is JSON web tokens, which gave us gems such as specifying a "null" authentication scheme, which libraries faithfully implemented, allowing a trivially hand crafted JWT to be used to "authenticate" anything an attacker would like. As with UUIDs, there's no defensible reason application-specific cryptographic metadata should be intelligible to the outside world at all.

# ? Nov 13, 2022 18:49

smackfu: Jun 7, 2004

Wonder how much of the worlds storage capacity is storing the dashes in UUIDs?

# ? Nov 13, 2022 18:59

wolfman101: Feb 8, 2004; PCXL Fanboy

Ralith posted:

A similar case of a spec in search of a problem is JSON web tokens, which gave us gems such as specifying a "null" authentication scheme, which libraries faithfully implemented, allowing a trivially hand crafted JWT to be used to "authenticate" anything an attacker would like. As with UUIDs, there's no defensible reason application-specific cryptographic metadata should be intelligible to the outside world at all.

I am a newbie wrt auth. With RS256 how does one craft a token client side? I thought the token could only be generated server side.

# ? Nov 13, 2022 19:35

dougdrums: Feb 25, 2005; CLIENT REQUESTED ELECTRONIC FUNDING RECEIPT (FUNDS NOW)

If my sickbrain is on the same page, the major issue is that you have to take the algorithm from the decoded token in order to verify the signature, so you can�t verify that the client hasn�t altered that field as there�s no way to know unless you just force an algo server side and ignore the alg field.

e: Which means if the server blindly accepts the header alg field being null, there�s no actual auth happening. And probably even if you pin them server side there could be quirks with parsing that bypass it.

dougdrums fucked around with this message at 19:52 on Nov 13, 2022

# ? Nov 13, 2022 19:45

dougdrums: Feb 25, 2005; CLIENT REQUESTED ELECTRONIC FUNDING RECEIPT (FUNDS NOW)

wolfman101 posted:

I am a newbie wrt auth. With RS256 how does one craft a token client side? I thought the token could only be generated server side.

You might already know these things but normally (well, ime) the jwt is signed by a third party auth vendor, they hand it off to the client, then it�s provided by the client to access stuff on your app. The payload and other fields of the jwt are not usually encrypted, only signed, so the client can change whatever they want in the jwt payload, and it�s up to the server to verify that the signature matches up with the payload. If the server is dumb and doesn�t pin specific algos, the client can (maybe creatively) set the algo to null and fill in the payload to auth as anybody.

# ? Nov 13, 2022 20:03

wolfman101: Feb 8, 2004; PCXL Fanboy

Cool, I had assumed the whole thing was encrypted.

# ? Nov 13, 2022 20:11

Ralith: Jan 12, 2011; I see a ship in the harbor
I can and shall obey
But if it wasn't for your misfortune
I'd be a heavenly person today

wolfman101 posted:

Cool, I had assumed the whole thing was encrypted.

If it was encrypted, how would you leak security critical implementation details and invite tampering?!

# ? Nov 13, 2022 23:03

Toshimo: Aug 23, 2012; He's outta line...

But he's right!

Actual PROD code received today:

VB Script code:

' Recursive Function to build a full directory structure
Sub BuildFullPath(ByVal FullPath)
  If Not objFSO.FolderExists(FullPath) Then
    objFSO.CreateFolder FullPath
  End If
End Sub

# ? Nov 18, 2022 19:37

Falcon2001: Oct 10, 2004; Eat your hamburgers, Apollo.; Pillbug

Toshimo posted:

Actual PROD code received today:

VB Script code:

' Recursive Function to build a full directory structure
Sub BuildFullPath(ByVal FullPath)
  If Not objFSO.FolderExists(FullPath) Then
    objFSO.CreateFolder FullPath
  End If
End Sub

is the horror that it's VBScript?

# ? Nov 18, 2022 22:08

Toshimo: Aug 23, 2012; He's outta line...

But he's right!

Falcon2001 posted:

is the horror that it's VBScript?

Well, there's that.

There's also that the original version you can steal from StackExchange or 100 other sites looks like this:

VB Script code:

Sub BuildFullPath(ByVal FullPath)
  If Not objFSO.FolderExists(FullPath) Then
    BuildFullPath objFSO.GetParentFolderName(FullPath)
    objFSO.CreateFolder FullPath
  End If
End Sub

Note the load-bearing recursive piece. The version I was given to deploy does gently caress-all if the parent directory doesn't exist, because they've taken out the most important line of code for no apparent reason.

# ? Nov 18, 2022 23:50

Wipfmetz: Oct 12, 2007; Sitzen ein oder mehrere Wipfe in einer Lore, so kann man sie ueber den Rand der Lore hinausschauen sehen.

I get nervous about a method called Build*() actually modifying the filesystem.
Because that code seems to use VBA's FileSystemObject.
Which has a function called BuildPath(), which does path concatenation without even looking at the filesystem.

tl,dr: Even the example is a horror.

Wipfmetz fucked around with this message at 15:28 on Nov 21, 2022

# ? Nov 21, 2022 10:43

dougdrums: Feb 25, 2005; CLIENT REQUESTED ELECTRONIC FUNDING RECEIPT (FUNDS NOW)

was brushing up on my razor after not using it for awhile and never realized that you can do this (this being vb)

code:

@Code
    Dim total = 0
    Dim totalMessage = ""
    if IsPost Then
        ' Retrieve the numbers that the user entered.
        Dim num1 = Request("text1")
        Dim num2 = Request("text2")
        ' Convert the entered strings into integers numbers and add.
        total = num1.AsInt() + num2.AsInt()
        totalMessage = "Total = " & total
    End If
End Code
<!DOCTYPE html>
<html lang="en">
    <head>
        <meta charset="utf-8" />
        <title>Adding Numbers</title>
        <style type="text/css">
            body {background-color: beige; font-family: Verdana, Ariel; 
                margin: 50px;
                }
            form {padding: 10px; border-style: solid; width: 250px;}
        </style>
    </head>
<body>
    <p>Enter two whole numbers and click <strong>Add</strong> to display the result.</p>
    <p></p>
    <form action="" method="post">
    <p><label for="text1">First Number:</label>
    <input type="text" name="text1" />
    </p>
    <p><label for="text2">Second Number:</label>
    <input type="text" name="text2" />
    </p>
    <p><input type="submit" value="Add" /></p>
    </form>
    <p>@totalMessage</p>
</body>
</html>

https://learn.microsoft.com/en-us/aspnet/web-pages/overview/getting-started/introducing-razor-syntax-vb

# ? Nov 21, 2022 23:00

shame on an IGA: Apr 8, 2005

https://twitter.com/Sibuna_Switch/status/1596768465095983104

# ? Nov 27, 2022 14:20

namlosh: Feb 11, 2014; I name this haircut "The Sad Rhino".

dougdrums posted:

was brushing up on my razor after not using it for awhile and never realized that you can do this (this being vb)

code:

@Code
    Dim total = 0
    Dim totalMessage = ""
    if IsPost Then
        ' Retrieve the numbers that the user entered.
        Dim num1 = Request("text1")
        Dim num2 = Request("text2")
        ' Convert the entered strings into integers numbers and add.
        total = num1.AsInt() + num2.AsInt()
        totalMessage = "Total = " & total
    End If
End Code
<!DOCTYPE html>
<html lang="en">
    <head>
        <meta charset="utf-8" />
        <title>Adding Numbers</title>
        <style type="text/css">
            body {background-color: beige; font-family: Verdana, Ariel; 
                margin: 50px;
                }
            form {padding: 10px; border-style: solid; width: 250px;}
        </style>
    </head>
<body>
    <p>Enter two whole numbers and click <strong>Add</strong> to display the result.</p>
    <p></p>
    <form action="" method="post">
    <p><label for="text1">First Number:</label>
    <input type="text" name="text1" />
    </p>
    <p><label for="text2">Second Number:</label>
    <input type="text" name="text2" />
    </p>
    <p><input type="submit" value="Add" /></p>
    </form>
    <p>@totalMessage</p>
</body>
</html>

https://learn.microsoft.com/en-us/aspnet/web-pages/overview/getting-started/introducing-razor-syntax-vb

drat, I knew time was a circle but I never saw classic Active Server Pages making a comeback

# ? Nov 27, 2022 21:22

hyphz: Aug 5, 2003; Number 1 Nerd Tear Farmer 2022.

Keep it up, champ.

Also you're a skeleton warrior now. Kree.; Unlockable Ben

Looking over a student's Python code, and see this:

code:

for mylist[1] in mylist:
  print(mylist)

I think I double-taked at that. That can't even parse, right? Even the peer assistant had written "I have no idea how this would be interpreted."

Shockingly, it does parse and run. I pop open a Python REPL and try a few horrors.

code:

>>> test = {"holy": "crap", "you're": "kidding"}
>>> for test["holy"] in test: print(test)

{'holy': 'holy', "you're": 'kidding'}
{'holy': "you're", "you're": 'kidding'}

code:

>>> lista = [1,2,3,4]
>>> listb = [0,0,0,0]
>>> x = 0
>>> for lista[x] in listb: x+=1
>>> lista
[0, 0, 0, 0]

code:

lista=[1,2,3,4,5,6,7]
listb=[0,0,0,0,0,0,0]
import random
for listb[random.randint(0,6)] in lista: pass

listb
[7, 6, 1, 0, 4, 0, 2]

Now, ok, I get that these all make sense if they are unwound into terribly written C for statements but still. A bit of faith in Python as a teaching language just died.

# ? Dec 3, 2022 18:58

Adbot: ADBOT LOVES YOU

# ? May 21, 2024 04:47

Dijkstracula: Mar 18, 2003; You can't spell 'vector field' without me, Professor!

It makes sense if (and probably only if) one keeps in mind that `for <lval> in <expr>` can take any lval; functionally it's not really much different from

code:

>>> i = 42
>>> for i in test: print(test)
...
{'holy': "you're", "you're": 'kidding'}
{'holy': "you're", "you're": 'kidding'}
>>> print(i)
you're
>>>

except that you're mutating the thing you're iterating over, and there's no equivalent to a ConcurrentModificationException in Python. Still, though, lol, lmao.

I'm increasingly convinced that the world decided python was a good teaching language because somebody (rightfully) got tired of making first-year students memorise "public, static, void, main, paren, String, args, bracket, bracket paren" without understanding it, and (wrongly) not realising that complexity is just getting pushed around

Dijkstracula fucked around with this message at 19:24 on Dec 3, 2022

# ? Dec 3, 2022 19:19

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Coding Horrors: You can gather all your technical debt into one easy framework!

«‹›1503 »