Coding Horrors: You can gather all your technical debt into one easy framework!

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Coding Horrors: You can gather all your technical debt into one easy framework!

«‹›1501 »

lifg: Dec 4, 2000; <this tag left blank>; Muldoon

ExcessBLarg! posted:

Yeah, Yacc is pretty weird.

The only thing I remember of Yacc is when I was having trouble in class and a friend told me, �don�t be clever, just add more rules.� And he was right.

# ? May 13, 2022 17:10

Adbot: ADBOT LOVES YOU

# ? Apr 26, 2024 05:49

CPColin: Sep 9, 2003; Big ol' smile.

BigPaddy posted:

At university one course was compiler construction. I wrote a Java compiler in Java down to generating the bitcode. I looked into that abyss for but a week and came away scarred.

Dang, that's eight times as much work as generating the bytecode! :v:

# ? May 13, 2022 17:20

D34THROW: Jan 29, 2012; RETAIL RETAIL LISTEN TO ME BITCH ABOUT RETAIL

I just found one of my very first Python projects, forked off from an old CLI iteration of the project I'm working on now. I thought I was loving slick.

I was so loving wrong.

# ? May 13, 2022 17:58

BigPaddy: Jun 30, 2008; That night we performed the rite and opened the gate.
Halfway through, I went to fix us both a coke float.
By the time I got back, he'd gone insane.
Plus, he'd left the gate open and there was evil everywhere.

CPColin posted:

Dang, that's eight times as much work as generating the bytecode!

Look it was 20 years ago ok.

# ? May 13, 2022 19:03

Carbon dioxide: Oct 9, 2012

# ? May 14, 2022 07:20

Foxfire_: Nov 8, 2010

Absurd Alhazred posted:

The only compiler you need is cat file > /dev/null.

Can someone debug why my code doesn't compile?
cat my.code > /dev/nu11

# ? May 14, 2022 07:47

QuarkJets: Sep 8, 2008

Foxfire_ posted:

Can someone debug why my code doesn't compile?
cat my.code > /dev/nu11

Works fine for me, closing ticket

# ? May 14, 2022 07:54

Sagacity: May 2, 2003; Hopefully my epitaph will be funnier than my custom title.

Foxfire_ posted:

Can someone debug why my code doesn't compile?
cat my.code > /dev/nu11

If you look closely, those aren't angle brackets, they're characters from the Canadian Aboriginal Syllabics block.

# ? May 14, 2022 07:58

Ola: Jul 19, 2004

This variable goes to nulleven.

# ? May 14, 2022 09:41

champagne posting: Apr 5, 2006; YOU ARE A BRAIN
IN A BUNKER

Ola posted:

This variable goes to nulleven.

turn the dial past 10, past 11, turn it up to null

# ? May 14, 2022 11:55

pokeyman: Nov 26, 2006; That elephant ate my entire platoon.

Carbon dioxide posted:

I�m only mad at not returning an enum.

# ? May 14, 2022 15:59

Macichne Leainig: Jul 26, 2012; by VG

pokeyman posted:

I�m only mad at not returning an enum.

if (DetectOS() != "dsfsjskljefjdlkfsflkjsdfs")

# ? May 14, 2022 16:01

Doom Mathematic: Sep 2, 2008

Carbon dioxide posted:

Huh, on the second call it turns out this Unix system has become Windows somehow.

# ? May 15, 2022 23:45

duck monster: Dec 15, 2004

So I left an internal project to hand it over to a new guy and move onto something non lovely.

This fucken guy convinced the boss to throw out the nodejs tcp server because "nodejs cant scale" and replace it with .... PHP ....

He's written this PHP daemon using forking for multitasking, this new thing is an entire gigantic file with no functions, just big ol' spaghettio, and it constantly pegs the server at 100% CPU because he doesnt understand multitasking at all. And to my horror, he's decided to replace the postgres DB with a mysql db with the following line ;-

code:

    $sql = "INSERT INTO  logs(`timestamp`,`type`,`message`)VALUES('$timestamp','$type','$message')";
    $conn->query($sql);
    $conn->close();

I'm attempting not to have an anneurism here..... He's not even doing the mysqli_real_escape thing. That message is poo poo coming straight over the the wire from devices that let people type data in. I havent seen code like this since the 1990s.

Lord have mercy, I think for the first time in years I'm going to ask the boss to fire someone.

I pine for the sweet embrace of death.

# ? May 19, 2022 09:35

D34THROW: Jan 29, 2012; RETAIL RETAIL LISTEN TO ME BITCH ABOUT RETAIL

Uh is he not sanitizing input or am I that inexperienced with SQL?

At least when I go hamfist on something I try to improve it and generally succeed. :wtc:

# ? May 19, 2022 13:33

BigPaddy: Jun 30, 2008; That night we performed the rite and opened the gate.
Halfway through, I went to fix us both a coke float.
By the time I got back, he'd gone insane.
Plus, he'd left the gate open and there was evil everywhere.

That is some tasty Bobby Tables. Whenever someone says �X doesn�t scale� I assume they mean they don�t know how to make it scale and don�t want to learn how to.

# ? May 19, 2022 13:41

Tei: Feb 19, 2011

duck monster posted:

I havent seen code like this since the 1990s.

maybe thats why, I could totally see somebody born less than 20 years ago make he mistake because have never seen what the bad code looks like --- somehow

# ? May 19, 2022 13:43

Obfuscation: Jan 1, 2008; Good luck to you, I know you believe in hell

The biggest horror is voluntarily rewriting something with php and mysql in 2022

# ? May 19, 2022 15:00

ExcessBLarg!: Sep 1, 2001

Wonder what his interview was like.

# ? May 19, 2022 15:08

Ranzear: Jul 25, 2013

I'd totally go build some API thing with PHP-FPM and MariaDB right now if I needed to. They both offer me a bunch of weird poo poo in terms of threading and clustering that gives me much less to do for scalability.

But ...

duck monster posted:

PHP daemon

This guy? This guy loving scares me. Please say 'j/k lol he had apache as reverse proxy for it' or something, immediately!

I'm having flashbacks to some ancient project to make an event-driven server in PHP with websocket support. I think it was confusingly also named react or maybe reactor or something. PHP does exactly one thing very well and should stay in its lane.

Edit: https://github.com/reactphp/reactphp

I don't hate it, but touting PHP 5.3 support is ... not helping my kneejerk.

Followup: Is he using mysqli at least? You only showed the $conn object. I'd half expect it's the original mysql_connect.

Ranzear fucked around with this message at 15:43 on May 19, 2022

# ? May 19, 2022 15:32

duck monster: Dec 15, 2004

D34THROW posted:

Uh is he not sanitizing input or am I that inexperienced with SQL?

At least when I go hamfist on something I try to improve it and generally succeed.

Aight, this is one people usually learned the hard way in the 90s.

Its an SQL injection risk. When you write an SQL query and directly inject user supplied strings into it, you end up with a situation where someone can write a specifically coded string that subverts the original sql into something evil.

So you take something like;-

code:

INSERT INTO  logs(`timestamp`,`type`,`message`)VALUES('$timestamp','$type','$message')

Then have something like $message=$_GET['message'] feeding it, then all an attacker has to do is send a url soeemthing like

http ://someurl/blah.php?message=');DROP TABLE logs;--

And instead of adding the message to the log, the log table is deleted, not just the data but the entire table.

So the correct practice is to use prepared statements. Something like this in pseudocode;-

code:

$query = "INSERT INTO LOGS(`timestamp`,`type`,`message) VALUES (?,?,?)";
conn->run_prepared($query,[$timestamp,$type,$message[);ki

(That probably wont run by the way, I dont know the command because I havent gone near PHP sql in a decade, I'm a python/C++ guy.).

Yes sanitizing those inputs helps, but its *rare* to find a sanitization method that hasnt been thoroughly defeated multiple times over by stupid poo poo like unicode exploits or whatever.

# ? May 19, 2022 17:46

duck monster: Dec 15, 2004

ExcessBLarg! posted:

Wonder what his interview was like.

I do not know, but it was during my week off work with the coronavirus, because I would have vetoed that dude *hard*

# ? May 19, 2022 18:06

OddObserver: Apr 3, 2009

Was there any performance problem to justify those "scalability" concerns in the first place?

# ? May 19, 2022 18:12

duck monster: Dec 15, 2004

OddObserver posted:

Was there any performance problem to justify those "scalability" concerns in the first place?

No. And he flat out lied to the boss about it.

I've been reviewing the code on this thing. I've found nearly 20 cases of string interpolation for queries, and when I looked at why we're not getting device notifications anymore on our AMQP network, he's replaced another nodejs system with a laravel instance where he's using DB::statement queries with, you guessed it, string interpolation queries.

And he's being coding directly to the production servers.

I've scheduled an emergency meeting with the boss, and shut down that server and revoked his passwords.

# ? May 20, 2022 08:41

ExcessBLarg!: Sep 1, 2001

He's definitely rogue. Look, I'm not a fan of nodejs either but I don't go around replacing production systems that are working just fine for the sake of it.

That said it's pretty strange he was hired with his particular skillset and then quickly given such level of access with little (official?) oversight.

# ? May 20, 2022 12:33

NtotheTC: Dec 31, 2007

ExcessBLarg! posted:

That said it's pretty strange he was hired with his particular skillset and then quickly given such level of access with little (official?) oversight.

"I don't have any official qualifications but I'm a self-starter. Blockchain bitcoin crypto NFTs crypto"

CEO: "here are the keys to the server room and access to prod"

# ? May 20, 2022 13:02

BigPaddy: Jun 30, 2008; That night we performed the rite and opened the gate.
Halfway through, I went to fix us both a coke float.
By the time I got back, he'd gone insane.
Plus, he'd left the gate open and there was evil everywhere.

Sounds like he is a self starter dev ops wizard that is seeing opportunities for rapid improvements and things like peer review or process is just a hinderance to him providing shareholder value.

# ? May 20, 2022 13:59

Absurd Alhazred: Mar 27, 2010; by Athanatos

Who's he related to?

# ? May 20, 2022 14:28

YanniRotten: Apr 3, 2010; We're so pretty,
oh so pretty

It takes more than a rogue engineer to make a rogue engineer.

It is worth some introspection about why this person has access to do whatever they want, however they want, with you only reviewing the work and finding problems after Ozymandias has completed his masterstroke.

Like yeah this person is bad but an environment that enables any of this to happen is also bad and you could stand to layer on somewhat more process so that you have any guard rails and seat belts.

# ? May 20, 2022 16:45

Ranzear: Jul 25, 2013

Why the gently caress do I try to do anything in powershell?

# ? May 20, 2022 16:57

New Yorp New Yorp: Jul 18, 2003; Only in Kenya.; Pillbug

Ranzear posted:

Why the gently caress do I try to do anything in powershell?

The horror is that they aliased invoke-webrequest to curl when the two aren't even close to equivalent and shouldn't be used interchangeably

# ? May 22, 2022 21:26

Xarn: Jun 26, 2015

I always wanted to know what hosed up chain of thinking led to the aliases in ps. It shouldn't take a genius to figure out that aliasing curl is a stupid idea, because there is no way you will have even 30% feature and flag parity.

# ? May 23, 2022 05:51

cheetah7071: Oct 20, 2010; honk honk; College Slice

I don't know how much of a horror story this is, but I recently had a case where a package I was using to open a file format for me was failing on some files I was absolutely sure were valid

it ended up having this code block in it:

code:

if (head12.version.minor < 2 || head12.version.minor > 4)
    return false;

In other words, if the version of the file isn't between 1.2 and 1.4, give up and don't even try to read it. Limiting yourself at 1.4 makes sense because 1.5 doesn't exist yet and if it ever does exist it might conceivably break something

But nothing actually changed between 1.1 and 1.2 that would even force you to write a new function. One byte in the header went from reserved to having a meaning, and a 1.2 file with that byte zeroed out has the exact same meaning as a 1.1 file so you don't even need to special-case it

Removing that check and then rebuilding it made it work perfectly

It would be one thing if this was some internal project that didn't want to handle old files, but this was a public, open-source library for managing the IO of a complicated file format. The only project I'm aware of that I know for sure uses this library instead of its main competitor just interfaces with it in an entirely different and way more complicated way to avoid having to call the function that just gives up on old files for no reason

# ? May 23, 2022 07:49

NihilCredo: Jun 6, 2011; iram omni possibili modo preme:
plus una illa te diffamabit, quam multæ virtutes commendabunt

I wish to confess this horror I just produced:

code:

/// Automatically handles async values to and from JSON
///  - On serialization, the value is executed synchronously and the result serialized
///  - On deserialization, the deserialized result is wrapped into a fake async that immediately returns the value
type AsyncConverter () = 
    inherit JsonConverter()

    override _.CanConvert t = 
        t.IsGenericType && t.GetGenericTypeDefinition() = typedefof<Async<_>>

    override _.ReadJson (reader, asyncT, _existingValue, serializer) = 

        let innerType = asyncT.GetGenericArguments()[0]

        let deserializedValue = serializer.Deserialize(reader, innerType)

        // reflection is needed to wrap 't into async<'t> without knowing 't
        let asyncReturn = typeof<AsyncBuilder>.GetMethod(nameof async.Return)        
        let asyncReturnT = asyncReturn.MakeGenericMethod(innerType)

        asyncReturnT.Invoke(async, [| deserializedValue |])

    override _.WriteJson (writer, asyncValue, serializer) =

        let innerType = asyncValue.GetType().GetGenericArguments()[0]
        
        // reflection is needed to unwrap async<'t> without knowing 't
        let asyncRun = typeof<Async>.GetMethod(nameof Async.RunSynchronously)        
        let asyncRunT = asyncRun.MakeGenericMethod(innerType)        

        let executedValue = asyncRunT.Invoke(null, [| asyncValue; None; None |])
                
        serializer.Serialize(writer, executedValue)

# ? May 23, 2022 14:13

rarbatrol: Apr 17, 2011; Hurt//maim//kill.

That's fun. I wonder if you could twist it into a tight enough knot to replace the generic inner value as a Lazy or something similar to avoid running it synchronously.

# ? May 23, 2022 14:57

NihilCredo: Jun 6, 2011; iram omni possibili modo preme:
plus una illa te diffamabit, quam multæ virtutes commendabunt

rarbatrol posted:

That's fun. I wonder if you could twist it into a tight enough knot to replace the generic inner value as a Lazy or something similar to avoid running it synchronously.

It might make sense when using the new System.Text.Json which has actual async support. Newtonsoft.Json is a synchronous library (the async functions are just wrappers) so it would just end up being called synchronously at some point.

# ? May 24, 2022 15:26

Beef: Jul 26, 2004

In a Makefile, at file scope:

code:


DIR = $(shell rsync ...)

# ? May 24, 2022 19:49

Loezi: Dec 18, 2012; Never buy the cheap stuff

God I hate working in academia at times. A database I need every few months is refusing connection. The phd student who set up the database and the server graduated and left something like two years ago. There is zero written documentation. Well, that's not strictly true. I was CC:d in an email back in 2019, where someone in a collaborating university sent us a database image saying "here's a new copy of the data". I know for a fact that isn't the latest version of the database.

I spent the first hour figuring out how to access the server (can't just SSH in, gotta proxy jump through another server) and then digging through /home to figure out what users exist on the system. The one called <project name> seems like the likely culprit. Also, I seem to have super user access to a server I barely knew existed until today, which is nice.

Changing to <project name>, bash history reveals a bunch of docker stuff, so perhaps the database was running in docker? Indeed, docker ps -a reveals only single image that someone(tm) exited 7 weeks ago. So it looks like we lost the database almost two months back, but because we have no monitoring, I'm only finding out now. Cool, not a problem.

But what's weird is that I'm not seeing any cases where <project name> is starting a docker image, just some monitoring and exits. Digging further back through the bash history, I noticed that they'd changed to the root user a bunch of times. I'm unclear why there's a need to do stuff as root when one has sudo and things run in docker, but whatever.

Turns out, the root bash history has a sequence of a sliiiiightly different docker run commands, but I have no idea what the billion arguments to them mean.

To recap, the person who set up the server is long gone. The person sending the 2019 email from the other university is also long gone. Someone manually shut down (what I'm assuming is) the database seven weeks back, but I have no idea who that was or why they did it. I don't know what the right docker magic is to restart the database. Because this is some academia stuff, the university level IT is going to have zero idea about 1) the weirdo database we are using or 2) the details of the setup for a server that was managed by a single PhD student.

This is going to be a long day.

# ? Jun 2, 2022 08:46

leper khan: Dec 28, 2010; Honest to god thinks Half Life 2 is a bad game. But at least he likes Monster Hunter.

Loezi posted:

God I hate working in academia at times. A database I need every few months is refusing connection. The phd student who set up the database and the server graduated and left something like two years ago. There is zero written documentation. Well, that's not strictly true. I was CC:d in an email back in 2019, where someone in a collaborating university sent us a database image saying "here's a new copy of the data". I know for a fact that isn't the latest version of the database.

I spent the first hour figuring out how to access the server (can't just SSH in, gotta proxy jump through another server) and then digging through /home to figure out what users exist on the system. The one called <project name> seems like the likely culprit. Also, I seem to have super user access to a server I barely knew existed until today, which is nice.

Changing to <project name>, bash history reveals a bunch of docker stuff, so perhaps the database was running in docker? Indeed, docker ps -a reveals only single image that someone(tm) exited 7 weeks ago. So it looks like we lost the database almost two months back, but because we have no monitoring, I'm only finding out now. Cool, not a problem.

But what's weird is that I'm not seeing any cases where <project name> is starting a docker image, just some monitoring and exits. Digging further back through the bash history, I noticed that they'd changed to the root user a bunch of times. I'm unclear why there's a need to do stuff as root when one has sudo and things run in docker, but whatever.

Turns out, the root bash history has a sequence of a sliiiiightly different docker run commands, but I have no idea what the billion arguments to them mean.

To recap, the person who set up the server is long gone. The person sending the 2019 email from the other university is also long gone. Someone manually shut down (what I'm assuming is) the database seven weeks back, but I have no idea who that was or why they did it. I don't know what the right docker magic is to restart the database. Because this is some academia stuff, the university level IT is going to have zero idea about 1) the weirdo database we are using or 2) the details of the setup for a server that was managed by a single PhD student.

This is going to be a long day.

This sounds like a much nicer problem than I deal with. Your PhD student likely didn't have malicious intent. It's not clear I can say the same for the (multiple teams, from different companies) contractors I work with. Or colleagues who don't understand any of the tricks contractors can use to milk more billable hours (in the immediate case, work-to-rule/work-to-spec) and presume general alignment and collaborative intent.

https://docs.docker.com/engine/reference/commandline/cli/

# ? Jun 2, 2022 13:05

Adbot: ADBOT LOVES YOU

# ? Apr 26, 2024 05:49

robostac: Sep 23, 2009

Have you tried just restarting the stopped container (via "docker start") instead of trying to run a new one?

# ? Jun 2, 2022 14:30

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Coding Horrors: You can gather all your technical debt into one easy framework!

«‹›1501 »