Coding Horrors: You can gather all your technical debt into one easy framework!

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Coding Horrors: You can gather all your technical debt into one easy framework!

«‹›5 »

Strong Sauce: Jul 2, 2003; You know I am not really your father.

No Safe Word posted:

For one of our clients (in the healthcare business) they literally had at least five (and I think it may actually have been seven) options in the gender field. I forget them all, but it was at least: Male, Female, Unspecified and I think there was a "Neither" or "Both" in there somewhere.

Obviously your healthcare has a few aliens under it's insurance policy :colbert:

# ¿ Jan 31, 2009 09:32

Adbot: ADBOT LOVES YOU

# ¿ Apr 18, 2024 10:08

Strong Sauce: Jul 2, 2003; You know I am not really your father.

That or he doesn't know how to create an array of objects :v:

# ¿ Feb 24, 2009 06:35

Strong Sauce: Jul 2, 2003; You know I am not really your father.

Why... why am I calling this private method...

# ¿ Mar 13, 2009 05:39

Strong Sauce: Jul 2, 2003; You know I am not really your father.

Mick posted:

I think I like this one better. I promise this has been in (at least) the last two releases.
code:
            if (!IsPostBack)
            {
            }
            else
            {
                
            }
The else block is a great use of negative space.

This code.. is art.

# ¿ Mar 29, 2009 22:43

Strong Sauce: Jul 2, 2003; You know I am not really your father.

While we're still talking about timezones...

https://www.eff.org/press/releases/eff-demands-withdrawal-bogus-time-zone-database-lawsuit

Large Hardon Collider posted:

I'm convinced these redirects are the web development version of the speed-up loop.

It took me a while to figure out they save the zip (to a cookie? session?) and then eliminate the query string. Or at least try to because he has too many parameters to str_replace.

# ¿ Jan 13, 2012 01:47

Strong Sauce: Jul 2, 2003; You know I am not really your father.

Hammerite posted:

It appears to pass the correct number of arguments to str_replace()?

The inefficiency of it comes because it redirects them unnecessarily. If they submit the GET variable 'zip' then a cookie is saved, then they get redirected. If they submit the GET variable 'latlng' they get redirected, then a cookie is saved, then they get redirected a second time. All of these redirects would appear to be unnecessary.

You're right I missed the nested str_replace in there.

I knew it was doing extra redirects. While I could see why he would redirect a lat/long query to one that redirected to whatever zipcode it was, that became irrelevant when he just redirected the zipcode after saving it into a cookie or session.

So essentially what you just said...

# ¿ Jan 13, 2012 06:28

Strong Sauce: Jul 2, 2003; You know I am not really your father.

Eliza posted:

It should be noted that input() in its current form is abolished in Python 3.x though. While the name of the function still remains, what's behind it is essentially 2.x's raw_input(). Unless I am mistaken, that one always returns a string and will be recognised as such, so this particular horror is something belonging to an ending pathway.

This whole discussion was started because of this difference... :psyduck:

# ¿ Jan 18, 2012 22:24

Strong Sauce: Jul 2, 2003; You know I am not really your father.

Internet Janitor posted:

My best guess is that "variable variables" are a popular feature because it lets you add a layer of indirection to references in a program without disturbing the code that already exists. Once you think of it in terms of hacking new stuff into existing codebases with minimal effort it makes a terrifying kind of sense.

(And Java is consistent- refererences are effectively a primitive type, and all arguments are passed by value. New objects are allocated precisely when there is a new keyword and are always accessed through a reference.)

I've never actually seen anyone use "variable variables" so I doubt that it is popular feature. However it does allow you to weed out bad programmers if they think that is the best method.

PHP can do pretty dumb things, and it gets labeled as a "beginner's language" so I guess is a bad combination. If I do use PHP for a project, I only work using a framework to avoid a lot of the crappy things PHP can do.

# ¿ Feb 15, 2012 00:16

Strong Sauce: Jul 2, 2003; You know I am not really your father.

Optimus Prime Ribs posted:

What version of PHP causes this?

I tried that here, and it works as it should:
http://ideone.com/OaHC4
http://codepad.org/HfFKOjed

Then I tried the it on my work's server (PHP 5.3.3, newer than Ideone's PHP 5.2.11), and it got the same, incorrect, 4/6.5/757 crap.

The hell is going on here?

According to the thread: this "optimization" https://github.com/php/php-src/commit/0accb4b0094b8fdda905e0a374843f0c775f4537

# ¿ Feb 21, 2012 20:56

Strong Sauce: Jul 2, 2003; You know I am not really your father.

Janin posted:

https://github.com/rails/rails/issues/5228

Russian programmer discovers massive security vulnerability in Rails. He reports it to the issue tracker, then the issue gets closed by Rails devs.

He uses it to re-open the issue, as a proof-of-concept.

Rails devs close it again.

He files Issue #5239: I'm Bender from Future. from the year 3012, and re-opens the original issue.

Rails devs close it again.

He submits a new file, "hacked", to the main Rails repository and re-opens the original issue.

Note that there are two distinct portions of this. One was that he posted this as a rails issue and when it was closed because the main rails committers said it was up to developers to implement checks, he exploited the rails app on GitHub (one of the larger rails running apps) to prove a point.

There has been tons of argument over what the default in rails should be, a lot of the main rail committers were opposed to the idea (I am not really sure the exact reason but it probably has something to do with having to be right all the time). This pretty much forced their hand in implementing a whitelist rather than the blacklist

# ¿ Mar 6, 2012 01:08

Strong Sauce: Jul 2, 2003; You know I am not really your father.

Optimus Prime Ribs posted:

I want to believe that a person didn't willingly type that out.
But I'm too cynical.

Do you think those programmers ever wonder, "drat I wish there was an easier way to do this. If only there were some sort of thingy that can hold all these similar items!"

I had something similar when I worked at company a few years ago. My company was expanding and hired a guy without ever asking me if I wanted to talk to him

Anyways, we don't interact much since his projects aren't the projects I'm working on for the site. But finally, I had to take over for one of his projects and as I'm browsing through the code, I see some code that outputs html like this.

code:

for ($i = 0; $i < $num_fields; $i++) {
  echo "Field " . $i . "<input name='field_" . $i . "'> ";
}

and then to process it

code:

for ($i = 0; $i < $num_fields; $i++) {
  if ($_GET['field_'.$i] == "BLAH") {
    // do stuff
  }
}

Needless to say, I ended up fighting constantly with him.

# ¿ Mar 23, 2012 20:23

Strong Sauce: Jul 2, 2003; You know I am not really your father.

yaoi prophet posted:

I've never even touched PHP, what's the proper way to do this?

The problem is that you want fields as an array, so there are two ways to accomplish this. Either have the inputs be named, "field[0], field[1], field[2], field[3]" or do it the easier way if you know that $arr[] = "blah" appends a new element to the end of the array you can do this:

code:

for ($i = 0; $i < $num_fields; $i++) {
  echo "Field " . $i . "<input name='field[]'"> ";
}

And it will grab all the inputs with that name and stuff them into an array accessed by $_GET['field']

And the second part is just part of the pain from the first part, but also what Optimus Prime Ribs said. I think PHP only returns a warning if an element you are referencing doesn't exist in an array so you can just surpress it but it's always good to actually check that an element actually exists using array_key_exists.

Strong Sauce fucked around with this message at 21:59 on Mar 23, 2012

# ¿ Mar 23, 2012 21:45

Strong Sauce: Jul 2, 2003; You know I am not really your father.

I don't know if I'd care if that was the only thing 'wrong' with the code.

# ¿ Mar 24, 2012 09:34

Strong Sauce: Jul 2, 2003; You know I am not really your father.

McGlockenshire posted:

Perl doesn't let you do one-line no-curly if statements... unless the statement precedes the if.

do_something() if($condition); do_something() unless($condition);

I miss this syntax so much...

Ruby allows this too.

# ¿ Mar 27, 2012 19:16

Strong Sauce: Jul 2, 2003; You know I am not really your father.

I do not get that style at all. More so when they say that function definitions should not indent curly braces. And then for switch/case statements a case doesn't get indented after the indentation form the curly brace.

I'm all for following coding styles but it should just boil down to a few things. Don't make me remember complex indenting rules.

# ¿ Mar 28, 2012 20:32

Strong Sauce: Jul 2, 2003; You know I am not really your father.

Did they seriously hard code every special offer code they have?

# ¿ Mar 29, 2012 02:19

Strong Sauce: Jul 2, 2003; You know I am not really your father.

pigdog posted:

I hope not to sound like a contrarian jerk... But aside from general badness and not putting start and expiry dates in the code it's not necessarily a bad idea to hard-code promotions like that, depending on circumstances. Making a nice administration UI for something like that an order of magnitude more work. If an offer is complex, then making it configurable is even more complex. If it's a small company, the number of offers and options are limited enough to have a grasp of, and it's easy to deploy new versions, then it may very well be easier to tell the VB programmer to update the code and redeploy. As opposed to spending a lot more resources, and dealing with a lot more integration, security and maintenance issues, to develop an interface for non-technical people who may end up needing the help of technical people regardless. At the very least they seem to have some code reuse going on, and have the offers separated into distinct methods/objects. Come to think of it, that code could look far worse.

Maybe I'm just jaded because the core "god" system in my company is extremely configurable, and all sorts of cool offers can be created on the fly, but the code itself is horrible and we're reliant on a subcontractor for more than a decade to keep the mess together. The accomplishment of the year was to get all that PL/SQL code finally on version control.

I agree with you, but there are tons of better ways than listing out every single discount.

At the very least there should be a separate text file with a hash of all possible "coupon" names. Then in each hash is an object that has something like, "description, type, value, num_discount_times" as strings and maybe an array "list_of_items" that contains a list of items that can use this coupon.

'description' is just a description of the coupon, 'type' is some ENUM that contains what kind of discount it is maybe, [percent_off, price_off, free], 'value' is the value based off what type is. E.g. if type = percent_off and value = 10, then its a 10% off coupon. 'num_discount_times' is another ENUM that determines how many times you should apply this coupon to an order which maybe contains [per_item, only_once]. I mean I've probably accounted for a large portion of what most companies want in their coupon/discount config.

So now that you have this hash, you have very simple if/then or switch statements in your actual controller code that can apply any type of discount written by the data in the hash, and if for example you need to handle expiration you can add a new property to the object and then rewrite code in the controller to handle expiration.

I don't think there needs to be a front-end to the discounts but writing every single possible coupon out like that either means the previous developer was extremely lazy or just not a decent developer.

Strong Sauce fucked around with this message at 09:02 on Mar 29, 2012

# ¿ Mar 29, 2012 08:59

Strong Sauce: Jul 2, 2003; You know I am not really your father.

The fact that it chugs on a x120e while seemingly not doing anything processor/graphic intensive is pretty frustrating. Wish they would clean the code up rather than add new things you have to worry about like hunger.

# ¿ Apr 8, 2012 07:44

Strong Sauce: Jul 2, 2003; You know I am not really your father.

Got to respect his ability I get his game into a playable state for release. I probably would have been stuck trying to make everything really efficient for no real benefit.

But really notch, improve the game so a NetBook can play it. Stop putting in dumb things no one likes

# ¿ Apr 9, 2012 01:02

Strong Sauce: Jul 2, 2003; You know I am not really your father.

My kingdom for a new LOL PHP error.

# ¿ Apr 9, 2012 08:57

Strong Sauce: Jul 2, 2003; You know I am not really your father.

Not sure about 'hate'. That HN thread seems on pretty even keel with a lot of people saying good and bad things about PHP. And overall I don't really see much comments about how the article sucked unless you imply that people who comment defending PHP hated the article.

# ¿ Apr 10, 2012 11:03

Strong Sauce: Jul 2, 2003; You know I am not really your father.

https://bugs.php.net/bug.php?id=54547

With rasmus reply!

# ¿ Apr 12, 2012 20:20

Strong Sauce: Jul 2, 2003; You know I am not really your father.

Yeah not sure why you assumed PHP forced some kind of weird internal MySQL representation, but you can create tables with ints, varchars, text, dates just like normal, it just pulls them out as strings since the reasoning is you're just going to output them to HTML.

# ¿ Apr 13, 2012 08:35

Strong Sauce: Jul 2, 2003; You know I am not really your father.

Suspicious Dish posted:

php:

<?php
function h3($body) {
?>
<h3><?= $body ?></h3>
<?php
}

h3("One");
h3("Two");
?>

code:

<h3>One</h3>
<h3>Two</h3>

The only coding horror is that he doesn't bother just using the short tags since he's already ruined it by having a "<?="

Why bother with "<?php" if you're already guaranteeing your script to fail when someone turns off short tag support.

Edit: Ah apparently since 5.4 <?= is accessible regardless of whether short tags is on or off... Certainly not a coding (implementation?) horror. No siree bob.

Strong Sauce fucked around with this message at 01:09 on Apr 20, 2012

# ¿ Apr 20, 2012 01:05

Strong Sauce: Jul 2, 2003; You know I am not really your father.

http://en.wikipedia.org/wiki/HTTP_referer

# ¿ Apr 20, 2012 23:25

Strong Sauce: Jul 2, 2003; You know I am not really your father.

Bhaal posted:

So my company has an "ancient" website (been around since ~2005). Kind of an entrepreneurial first draft business website by the company's founders. It was made by some outside group that was gone before the CTO ever came aboard years ago; he counts himself lucky that he has full access to the hosting account that the server runs through. The site is very simple and "works", plus the company changed its focus years ago and that site only sees a trickle of clients and is all managed by one of the senior sales/account managers. Nobody in IT has had to ever go near it.

Cut to this morning, suddenly they need some mostly cosmetic changes to the site and the sales/account manager guy decides to email me about it. I figure it's a 5 minute deal so whatever, I drum up the server credentials and log in. Here's the highlights of what I find about this site:

1) PHP is a mess of logic, presentation, and data all dovetailed together in one giant ball. Okay, and the CTO warned me about that the last time we ever talked about the old site. But that's not the worrying part...

2) All db queries are hand crafted in php and--you guessed it--pull directly from post/get variables, raw and unescaped. That's super unpleasant, but at least the database is isolated to just this trainwreck of a site. Then I notice the even bigger worry...

3) All passwords are stored in plaintext. Oh, and of course we have their email addresses too, along with all other sorts of contact info. The rowcount in users is about 800.

At the very least, payment is handled by an outside invoicing system that is secure, so there's no CC info in that db (I went through every single table to make sure). Our main site has to be HIPAA compliant as we deal with SSNs and medical data and so on. This site I'm pretty sure doesn't need to fall under HIPAA but it's still pretty unsettling and now I've just created a bunch more work by discovering how easily that data will be compromised.

Now I want the name of the group or person who made that site just so I can follow up and verify they're not making websites for anyone anymore.

I don't know what to tell you other than condolences, but it's probably best to not think that most developers write code like that (because they do).

At the very least when I first heard about SQL injection I got real nervous and used addslashes at the very least, then eventually the mysql_escape_string function.

Note: I always thought it was PHP's terrible decisions that led the current escape string function to be called, "mysql_real_escape_string" but apparently this is MySQL's doing as PHP is just copying the function name implemented in MySQL API :psyduck:

# ¿ Apr 25, 2012 20:09

Strong Sauce: Jul 2, 2003; You know I am not really your father.

ShadoX posted:

And now the real answer: Parameterized queries.

Suspicious Dish posted:

All of which are the wrong solution, and can be bypassed in novel ways. Use prepared statements.

I didn't propose addslashes nor mysql_escape_string as being the right answer. I was relating to how I at least tried to do something when I first heard about SQL injection and the lack of effort in safeguarding the query was terrible. Since prepared statements/parameterized queries have only been in PHP since ~5.0, that's not exactly a solution I could have used.

# ¿ Apr 26, 2012 00:58

Strong Sauce: Jul 2, 2003; You know I am not really your father.

Ender.uNF posted:

Holy gently caress.

Well PHP did have mysql_real_escape_string which works just fine (and still does) in preventing SQL injections as long as you craft the SQL string properly, and there were libraries that emulated parameterized queries that essentially did some scrubbing of the input. Obviously with the new PDO libraries it looks much cleaner and makes it less-prone to developer laziness.

# ¿ Apr 26, 2012 01:12

Strong Sauce: Jul 2, 2003; You know I am not really your father.

Thermopyle posted:

This is probably a coding horror in and of itself, but I can't stand XML and I can't really articulate any reason that an XML-defender couldn't give an answer of some sort to.

It's ridiculous verbosity? The fact that people misuse it and just shove everything into XML?

There are obviously some good use cases for XML, somewhere down the line someone thought to use XML for everything. See: Java

# ¿ Apr 27, 2012 22:56

Strong Sauce: Jul 2, 2003; You know I am not really your father.

I would say I'm pretty well seasoned in PHP, but 1) I never knew == was not transitive and 2) I never knew "php" == 0 is true, which is probably why I assumed == would be transitive.

Man, that is truly horrible.

# ¿ May 10, 2012 22:28

Strong Sauce: Jul 2, 2003; You know I am not really your father.

ToxicFrog posted:

Does it make me a bad person that I want to find out who it was and then buy them your avatar?

What does ITT mean here?

Also - even apart from TMMM and the non-fungibility of programmer time - caffeine? Was he joking, or does he think that wiring the students up on caffeine will help them work faster?

Or does he think the answer is to work super-long hours and stay awake using coffee so they can make more fatigue-related mistakes per day?

If you're not American, ITT is essentially a degree mill with a focus on technology, although I remember them expanding into crime/law enforcement related fields.

# ¿ May 14, 2012 23:46

Strong Sauce: Jul 2, 2003; You know I am not really your father.

Zamujasa posted:

*Don't know how to use arrays....*

Apparently this is a common sickness...

http://forums.somethingawful.com/showthread.php?threadid=2803713&pagenumber=281&perpage=40#post401853293

# ¿ May 18, 2012 01:56

Strong Sauce: Jul 2, 2003; You know I am not really your father.

Apparently the cost of not having to deal with a bajillion my password doesn't work support requests. Must have been a lot of calls/emails.

# ¿ May 23, 2012 18:52

Strong Sauce: Jul 2, 2003; You know I am not really your father.

quiggy posted:

That password is longer than 16 characters, so you can't use it on Battle.net, and is extremely vulnerable to a dictionary attack.

Goddamn that is a pretty thorough dictionary if they have, "fuckthisgayearth"

# ¿ May 23, 2012 21:16

Strong Sauce: Jul 2, 2003; You know I am not really your father.

Fren posted:

Functional programming in zsh.

$ sum(){ foldl λ a b . 'echo $(($a + $b))' } $ list {1..100} | sum 5050

Do you really have to use that lambda character?

# ¿ May 24, 2012 06:21

Strong Sauce: Jul 2, 2003; You know I am not really your father.

The whole point of JSON was to be more lightweight than XML, I'm against anything that is going to signficantly bloat JSON libraries or its underlying structure. That said, just give me JSON + a way to handle binary blob data well. If implementing hexadecimals allows this to happen, so be it. But I guess what I want is just JSON+BSON.

# ¿ May 29, 2012 19:20

Strong Sauce: Jul 2, 2003; You know I am not really your father.

Maybe allow base64 encoded strings as literals, saves two bytes from the quotes :v:

Seems like transporting large blobs of binary data might be useful to some people and I can think of one reason why I'd rather transport the raw binary rather than an base64 encoded string but it's a probably a pretty specific use case.

Just something I wouldn't mind if they implemented into some future version of JSON. But then it wouldn't be able to use it anyways while we wait for users to stop using older browsers/implementations.

Strong Sauce fucked around with this message at 22:47 on May 29, 2012

# ¿ May 29, 2012 22:43

Strong Sauce: Jul 2, 2003; You know I am not really your father.

Internet Janitor posted:

Not to pick on you, but:

Well like I said, I'm not exactly handling large blobs of data using JSON right now, so there's no real effect on me. I merely stated that I could see that some people would find use in having JSON support a raw binary blob. MongoDB's already taken that idea and implemented it with BSON so Crockford saying that doesn't mean it'll stop people from implementing variations on his original idea.

# ¿ May 30, 2012 00:53

Strong Sauce: Jul 2, 2003; You know I am not really your father.

Yeah that bit about "micro" and "soft" not relating to my PENIS was kinda of awkward and weird but I'm more offended by the dance number, specifically that developers at a conference want something like that.

# ¿ Jun 9, 2012 02:10

Adbot: ADBOT LOVES YOU

# ¿ Apr 18, 2024 10:08

Strong Sauce: Jul 2, 2003; You know I am not really your father.

So what you're saying is, we're going to run out of IPv6 addresses because every atom in the universe wants to be a wifi hotspot?

# ¿ Jun 11, 2012 01:42

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Coding Horrors: You can gather all your technical debt into one easy framework!

«‹›5 »