Error'd: Good Time
Astute readers noticed last week that this editor (that is to say, me) had his own error'd failure to remember what day it was. Thank you for pointing it out promptly, and then proceeding to send in a bunch of examples of other sites calendar failures. Misery loves company!
Traveler's travails, from C_Chell "Trying to complete the form on https://www.ihg.com to tell when I plan to arrive at the hotel, I can't complete the form because of this little time problem."
"You Have -1 Month(s) To Order!" announces dragoncoder047. "Ah, GradImages... the company that told all graduates that they'd get a free 5x7 but tried to charge me for it, then refused to honor my "unsubscribe" request and is *still* emailing me to this day... Can't do date math? Par for the course."
"Stansted Temporal UI design" shared by Michael R. "While waiting for a friend to arrive at Stansted I see this. I better fire up the DeLorean to pick her up at 00:06 tomorrow."
While he was hunting through the website, Michael R. also found that "The Stansted airport website seems to suffer from Directional Confusion."
Nothing wrong with the calendar here, but
Slaoput simply opposes mandatory existence.
"I was filling out a form that said the Birthdate
is optional, but when I hit submit I found out
it was required. (I guess technically you have to be
born to fill out the form.)"
NOT TO BE!
[Advertisement] Picking up NuGet is easy. Getting good at it takes time. Download our guide to learn the best practice of NuGet for the Enterprise.
CodeSOD: Heating Up
A common option for retrofitting heating and cooling into older homes is a mini-split, frequently tied to a heat pump. They're (relatively) cheap to install, energy efficient, and can be added without substantial modifications to the home. They also, annoyingly, are mostly controlled via IR remotes, making them challenging to wire up to home automation or even a household thermostat.
People have made solutions, and today's code comes from one of those solutions. Which, I want to stress, this code comes from an open source project for home automation, so it's not the code that's wrong, here. At first I thought it was, and had a moment of, "I'm not going to pick on some hobby project," but then I realised the hobby project points at a deeper issue.
// temperature helper these are direct mappings based on the remote float toFahrenheit(float fromCelsius) { // Lookup table for specific mappings const std::map<float, int> lookupTable = { {16.0, 61}, {16.5, 62}, {17.0, 63}, {17.5, 64}, {18.0, 65}, {18.5, 66}, {19.0, 67}, {20.0, 68}, {21.0, 69}, {21.5, 70}, {22.0, 71}, {22.5, 72}, {23.0, 73}, {23.5, 74}, {24.0, 75}, {24.5, 76}, {25.0, 77}, {25.5, 78}, {26.0, 79}, {26.5, 80}, {27.0, 81}, {27.5, 82}, {28.0, 83}, {28.5, 84}, {29.0, 85}, {29.5, 86}, {30.0, 87}, {30.5, 88} }; // Check if the input is in the lookup table auto it = lookupTable.find(fromCelsius); if (it != lookupTable.end()) { return it->second; } // Default conversion and rounding to nearest integer return roundf(fromCelsius * 1.8 + 32.0); }Okay, I am going to pick on their code a little bit; using float as a key in a map is asking for trouble, because rounding errors are going to surprise you. But honestly, failing to find the key you're looking for is better than the opposite, since that actually does the correct thing. Because if you look carefully at the table, you'll see that it's wrong.
18C, for example, should be 64F. Well, 64.4F, but we're rounding to an integer. The choice here is to roughly map every 0.5C increase to a 1F increase, which is not the conversion factor. They try and correct- note how the table mostly steps by 0.5C, but skips 19.5C.
The opposite direction is similarly bad:
// temperature helper these are direct mappings based on the remote float toCelsius(float fromFahrenheit) { // Lookup table for specific mappings const std::map<int, float> lookupTable = { {61, 16.0}, {62, 16.5}, {63, 17.0}, {64, 17.5}, {65, 18.0}, {66, 18.5}, {67, 19.0}, {68, 20.0}, {69, 21.0}, {70, 21.5}, {71, 22.0}, {72, 22.5}, {73, 23.0}, {74, 23.5}, {75, 24.0}, {76, 24.5}, {77, 25.0}, {78, 25.5}, {79, 26.0}, {80, 26.5}, {81, 27.0}, {82, 27.5}, {83, 28.0}, {84, 28.5}, {85, 29.0}, {86, 29.5}, {87, 30.0}, {88, 30.5} }; // Check if the input is in the lookup table auto it = lookupTable.find(static_cast<int>(fromFahrenheit)); if (it != lookupTable.end()) { return it->second; } // Default conversion and rounding to nearest 0.5 return roundf((fromFahrenheit - 32.0) / 1.8 * 2) / 2.0; }Here, we can be off by as much as a 1C, which is certainly a noticeable feeling.
At first glance, I thought this was just a misguided attempt at optimizing the lookup. For common values, do a lookup instead of calculating because it's faster. Seems like the kind of mistake a hobby project might make, and definitely not a WTF. But it's the comment which corrects me: these are direct mappings based on the remote.
These remotes usually have a display. So when you see on the remote that you're trying to set the temperature to a comfortable 72F, the remote is actually sending 22.5C to the unit. That's the actual temperature being sent.
Now, why on Earth does the remote behave this way? Well, I haven't cracked one open to read off the part numbers, but I'm going to go out on a limb and guess that the microcontoller in the remote doesn't handle floating point operations all that well. So it almost certainly does use a lookup table to decide what signal to send, and the lookup table is populated by "good enough" approximations of temperature conversions. There aren't a lot of places that use Fahrenheit, so being "close enough" is a reasonable solution. If you want accurate temperatures, use SI units, not "freedom units".
In the end, I'd say that neither the hobby project, nor the remote control are the WTF here; locales that insist on using weird ass units are.
.comment { border: none }What You Measure
Rachel joined a new team which was proudly "metrics driven". When she first met with her boss, Zane, he explained his thinking.
"We need to be data-driven to make good decisions, right? We're a manufacturing company. We make widgets. At the end of the day, we need to make the most widgets for the lowest cost of goods sold. So we track that, and that feeds into every decision."
The team oversaw an automated production line, which meant the software was a mix of robotics, embedded firmware, high-level web based monitoring tools, and thickets of dreaded PLC code. And because you can't build an entire factory for test purposes, they only way they could test real-world scales with real-world data was to roll changes out to production. They could simulate, they could run tests on subsets of the system, but a change in the production line software couldn't truly be validated until it rolled out into the real world.
Rachel's first task on the new team involved making some changes to their metrics dashboard. It was viewed as a good way to get her feet wet with the new team. As it turned out, the metrics dashboard was a Google Sheet, with a complex series of formulas that involved multi-level INDEX functions- essentially querying the spreadsheets like they were a database. Why not use an actual database? Oh, they did — six actually — but the company obeyed Remy's Law of Requirements Gathering: "no matter what the requirements the users ask for, what they really wanted was Excel". The database data was pulled into the spreadsheet for reporting.
Now, a complicated sheet pulling in data from not one, but six different databases, they must have a pretty complex model to explain how changes to their software would impact productivity. And since they needed to model the software to make predictions about how it'd behave in production, that model must be extremely useful.
Of course it wasn't. The only metrics they tracked were output metrics, variations on "widgets produced per unit time". There were some performance metrics, so you could maybe potentially identify "oh, our overall throughput dropped because unit 5 became a bottleneck and started taking 1.5 extra seconds per widget", but nothing that actually helped you understand how the complex system made decisions. Or even why unit 5 was taking longer.
For example, there was an automated quality control scanner. It examined widgets as they came off the line, and rejected defective ones based on a computer vision algorithm. Did that subsystem record why it rejected a widget? No, it did not. The CV model was able to tag widgets with a defect category based on what it saw, but that information didn't get recorded anywhere. In fact, it didn't even record how many widgets got rejected. The only way to know was to have an operator on the assembly line count widgets in the bin manually. Since that ate up a bunch of an operator's time, it never happened unless the developers begged for it. And since the operator still couldn't answer the question "why was this widget rejected", it wasn't all that useful anyway.
Every change to the software was scored against the overall output metrics. This meant that when Rachel was ready to push out her first software change, something that would record how many widgets were rejected and why, whether or not it could be deployed was dependent on seeing the change improve, or at least not regress, the widgets-over-time scores. But the widgets-over-time were a noisy metric; it varied based on which operators were working any given shift, or based on supply chain constraints. Or sometimes, based on when one of the machines was last calibrated- theoretically something that happened on a set schedule, but really was up to the operators. This meant the first three times Rachel rolled her code out for a test run, the metrics regressed. Nothing she changed should have impacted the metrics, but the metrics regressed due to environmental issues.
This meant making a simple change could take weeks, because you could only do final validation on the real system, which means you had to mark off a block of time for a test run, you could only run a handful of tests a day, and if metrics regressed you had to account for that before you could release the software for actual production use.
Over the first few months, Rachel added instrumentation to the code. Anything along the way to generating an output widget, she recorded. The hope was that once they had enough data, they could build a useful model of the system. Unfortunately, Zane had other ideas.
"So, you haven't improved our metrics," Zane said. "Which, I remind you, we're a metrics driven organization. Every change needs to improve our metrics."
"Sure, but I'm gathering more data so we have a better idea of what makes our metrics tick. We don't know why our system does some of the things it does, because we don't record any logging about the decisions it makes."
"Right, but we already gather the key metrics."
"But you don't gather the data that tells you why those metrics are what they are!"
"Sure," Zane said. "But those aren't our key metrics."
That, unfortunately for Rachel, was where things landed. Understanding their complex system was a low priority. Pushing top-level metrics without understanding what fed into them, that was the priority. That didn't mean Rachel was powerless: any time she made a change that she thought might help the top level metrics, she also made sure to add instrumentation that explained how that change behaved. It was the compromise that kept Zane happy: she released features that impacted the top-level metrics, but she also made the system more observable.
Representative Line: So Much Room
Today's representative comment ran out of room.
int maxLen = getColumnSize(session, "audit", "text_value1") - 16; // Leave some room forNo, it isn't continued on the next line and just got trimmed out, except perhaps by a careless merge. This is the entire comment.
Clearly, written by David Chase, the creator of "The Sopranos".
There are so many things we might be leaving room for. We could leave some room for dessert. Leave some room for activities. Leave some room for the holy spirit. Leave some room for improvisation.
Tales from the World Cup
All I can say in response to our anonymous submitter's story is, ALMOST?!
With the World Cup being hosted in North America this year, I remembered this story that happened back in 2014. At the time I was working in Brazil, for a company that builds software systems for public services. And, with the World Cup being hosted there, in came the opportunity for local agencies to invest in modernization, with pretty much a blank check to get new services, so long as it was deployed before the end of the World Cup. And so the sales people did what they did best, and went around trying to upsell whoever would be willing to buy — no matter our actual capacity for developing the things.
So it was that I was pulled into this new fancy digital system for the police force of a state capital. However, we had only about 4 engineers available, and what they sold was a project estimated for a team of 20, to be delivered in 3 months, with no room for delay. And it wasn't just our core C&D product, but this massive thing with customized public-facing websites, live tracking of the position of different police cars delivered to a tablet in each car, automated reporting, etc.
First thing: We received a pile of 24 resumes, and were told to choose 16 of those. Maybe 3 were acceptable, but we had to waste 1 month hiring and onboarding 13 other people who were worse than useless. Classic man-month problem. We eventually had to tell management that nothing would be delivered this way, so they did the very best next thing: fly us to this other city, so we could work embedded there, in full crunch mode for the delivery. We pretty much worked 12+ hours a day, 7 days a week, for those next 2 weeks.
Another situation: they wanted this system where people could take a photo of an incident in progress, and submit via this app + website, to be verified by an operator in real-time. We nicknamed it the "dick-pic encyclopedia." Even worse, we only had the budget to run a single server, so this thing receiving public traffic would live in the same system that was tracking police car locations. Luckily they were convinced it was a bad idea so it was only ever online for a short period of time.
Next, was the police car tracking. This was done by a tablet installed in each car, which would be sending and receiving location information. But, 1 week before our deadline, we were hitting a serious bug: everything was working when we ran the tests ourselves, but the cops would report very weird bugs when testing it in the field. So we asked to do some field debugging, and I went on a ride-along. Things were working pretty much fine everywhere, so I asked to be taken to where he remembered seeing the tablets fail—to which the policeman just decides to drive off straight into one of the favelas around the city. I guess I can cross out "doing debugging in a police car passenger seat in a notoriously dangerous neighborhood" off my bucket list. Root cause: turns out cellphone connections would be pretty spotty in those areas, which we weren't handling properly.
Either way, we delivered something on time that was severely below spec, and very much over-budget. Company tried to squirm out of paying overtime (was told that we would gain "prestige" by doing those extra hours), but I put my foot down and left that job shortly after. Last I heard they actually got sued for this and a bunch of similar projects, and almost went under.
Error'd: Hello, New Mexico!
Peter G. shared with us yet another ordering bungled example of. "Should really say "please engage in an Easter egg hunt to find your language"."
"Google can't count" claimed Peter S.. It adds up. "Yet another proof that 0=1, this time from Google."
"Thanks, Microsoft" groused Ivan "Ever since Microsoft ate university e-mail services worldwide and became responsible for major free software mailing lists, quality of service has been steadily dropping. In order to report delivery problems to Outlook, you need a Microsoft account. You're prevented from creating it at first because of "suspicious activity". Once you're in, the contact address is pre-filled for you with an invalid email. Once you fix that in the web developer toolbar, fuck you anyway! I think the form isn't actually expected to work; the fact that the request was submitted is an error. The only thing missing from the experience is the "beware of the leopard" sign."
"Mango Math" needs a bit of money math for the rest of the world to understand. Michael R. muttered "I will buy it by the slice then." The joke here is on the tip of my tongue. Explainer: the new pence is one hundredth of the decimal pound. No shillings no more, decreps! At that ratio, 3p per slice of cheesecake would indeed be far less dear than four pounds for the whole thing, barring translucent slices. Alas, the reality is simply the boring fact that the price is 3p per gram. Not as funny but I'm chuckling imagining Michael's transparent serving of diet cheesecake. I'll leave it up to you to decide if a gram really counts as an "item".
Clint clucked "Got this email from Bigbadtoystore. Lots of links available for preorder!" I think the talented website builders behind the New Mexico DOT have been busy.
[Advertisement] Picking up NuGet is easy. Getting good at it takes time. Download our guide to learn the best practice of NuGet for the Enterprise.
CodeSOD: The Big Family
Some time ago, Charles shared with us some awful PHP, aka the most common sort. Today's code sample is maybe a little too big to sum up, but I'll let Charles take a crack at it.
It's so bad that even analyzing and laughing at it feels impossible. But it’s so bad, I couldn’t not share it.
I’m the only one handling all the IT-related tasks at my company, and I don’t have anyone here to vent or laugh about this kind of thing with. So, I figured, why not share it here? I’m hoping it’ll provide at least a little bit of catharsis or some dark humor.
To make sure the confidentiality of the codebase was respected, I took the liberty of generalizing it. You might notice some inconsistencies, but that’s just me trying to keep things neutral while protecting the original structure and functionality. Apologies if it looks a bit patchy – the goal was to avoid revealing any specific details or sensitive code.
The whole block is north of 400 lines, and it's doing a lot. Or well, maybe it's not, as you'll see.
Let's star with the outermost layer.
$resm_data = $data_source->fetchData("group=" . $item_id); foreach ($resm_data as $key => $value) { // rest of the code here }We fetch data from a data source, presumably a database, passing our condition as a string, which reeks of probable SQL injection, but I don't know what library they're using. I also note they're using the key/value style of array iteration, but never actually check the key.
$option_id = $value->option_id; $resm_details = $detail_source->fetch($option_id); if ($resm_details) { $label = $resm_details->{"label$lang"}; $description = $resm_details->{"description$lang"}; $category = $resm_details->category;Nice little bit of "meta" programming to get their localization working, it'll fetch labelen or labelde as needed. Definitely not a horrible, dangerous way to solve that problem.
We use that again to get our currency figured out. That lets us do number formatting. So much number formatting code.
if ($category == 0) { $cost = $resm_details->{"cost" . $currency}; $child_cost = $resm_details->{"child_cost" . $currency}; $cost_info = $mot[101] . " : +" . number_format($cost, 2, ",", " ") . $currency_symbol . " - " . $mot[102] . " : +" . number_format($child_cost, 2, ",", " ") . $currency_symbol; } elseif ($category == 1) { $cost = $resm_details->{"cost" . $currency}; $child_cost = 0; $cost_info = $mot[101] . " : +" . number_format($cost, 2, ",", " ") . $currency_symbol; } elseif ($category == 2) { $cost = 0; $child_cost = $resm_details->{"child_cost" . $currency}; $cost_info = $mot[102] . " : +" . number_format($child_cost, 2, ",", " ") . $currency_symbol; } elseif ($category == 4) { $cost = $resm_details->{"cost" . $currency}; $child_cost = 0; $cost_info = $mot[500] . " : +" . number_format($cost, 2, ",", " ") . $currency_symbol; } elseif ( $resm_details->{"cost" . $currency} == 0 and $resm_details->{"child_cost" . $currency} == 0 ) { $cost = 0; $child_cost = 0; $cost_info = ""; } else { $cost = $resm_details->{"cost" . $currency}; $child_cost = 0; $cost_info = $mot[200] . " : +" . number_format($cost, 2, ",", " ") . $currency_symbol; }What is the $mot array? Why am I jumping to seemingly random locations in that array? Clearly it contains some headers for our output.
Anyway, there's plenty of HTML string munging happening too, don't you worry.
if ($location == 1) { $quantity_block = '<div class="quantity-container"> <input type="text" value="1" id="quantity-' . $option_id . '" class="qty-control" name="quantity" min="1" max="1"> <div class="increase button">+</div> <div class="decrease button">-</div> </div>'; $quantity = 1; } else { $quantity_block = ""; $quantity = "all"; }And then there's this little treat for parsing the time stored in our database: $time_data = json_decode($resm_details->time_data); That tells me they're storing date times as strings, so that's fun.
There are also a couple more bon mots as they build a drop down list:
$departure_select = '<option value="-1">' . $mot[300] . '</option>'; $arrival_select = '<option value="-1">' . $mot[301] . '</option>';And then there's this monstrosity:
// Add the main option to the template $TEMPLATE->SET_BLOCK_VARIABLES("Block_OPTIONS", [ "ID" => $option_id, "QUANTITY" => $quantity, "LABEL_CLASS" => $label_class, "ACTION_CLASS" => $action_class, "LABEL" => $label, "DESCRIPTION" => $description, "QUANTITY_BLOCK" => $quantity_block, "COST_INFO" => $cost_info, "HOST_COST_DISPLAY" => $host_cost_display, "COST" => $cost, "CHILD_COST" => $child_cost, "LOCATION" => $location, "CATEGORY" => $category, "HOST_CLASS" => $host_class, "EXTRA" => $extra, "HOST_EXTRA" => $host_extra, "TIME_CHECKED" => ($has_times == 1) ? 'selected="' . $option_id . '" checked="true"' : '', "TIME_BLOCK" => $time_block ]);All the nonsense that we concatenate together above gets shoved into some sort of template. And after that, that's where the good stuff starts. Because guess what? We have to do the same thing for child items.
$resm_children_data = $data_source->fetchData("parent=" . $option_id); foreach ($resm_children_data as $child_key => $child_value) { $child_option_id = $child_value->option_id; $resm_child_details = $detail_source->fetch($child_option_id);That's right, it's the same block of code, not quite copy/pasted, since they needed to put the word child in everything.
// Add the child option to the template $TEMPLATE->SET_BLOCK_VARIABLES("Block_OPTIONS.Block_OPTIONS_CHILD", [ "ID" => $child_option_id, "QUANTITY" => $child_quantity, "LABEL_CLASS" => $child_label_class, "ACTION_CLASS" => $child_action_class, "LABEL" => $child_label, "DESCRIPTION" => $child_description, "QUANTITY_BLOCK" => $child_quantity_block, "COST_INFO" => $child_cost_info, "HOST_COST_DISPLAY" => $child_host_cost_display, "COST" => $child_cost, "CHILD_COST" => $child_extra_cost, "LOCATION" => $child_location, "CATEGORY" => $child_category, "HOST_CLASS" => $child_host_class, "EXTRA" => $child_extra, "HOST_EXTRA" => $child_host_extra, "TIME_CHECKED" => ($child_has_times == 1) ? 'selected="' . $child_option_id . '" checked="true"' : '', "TIME_BLOCK" => $child_time_block ]);And now, if you liked the child record, guess what? Those children have got siblings. What can I say, it's a big family.
$resm_sibling_data = $data_source->fetchData("parent=" . $parent_option_id); foreach ($resm_sibling_data as $sibling_key => $sibling_value) { $sibling_option_id = $sibling_value->option_id; $resm_sibling_details = $detail_source->fetch($sibling_option_id);And that means, yes, we also use that template thing again:
// Add the sibling option to the template $TEMPLATE->SET_BLOCK_VARIABLES("Block_OPTIONS.Block_OPTIONS_CHILD", [ "ID" => $sibling_option_id, "QUANTITY" => $sibling_quantity, "LABEL_CLASS" => $sibling_label_class, "ACTION_CLASS" => $sibling_action_class, "LABEL" => $sibling_label, "DESCRIPTION" => $sibling_description, "QUANTITY_BLOCK" => $sibling_quantity_block, "COST_INFO" => $sibling_cost_info, "HOST_COST_DISPLAY" => $sibling_host_cost_display, "COST" => $sibling_cost, "SIBLING_COST" => $sibling_extra_cost, "LOCATION" => $sibling_location, "CATEGORY" => $sibling_category, "HOST_CLASS" => $sibling_host_class, "EXTRA" => $sibling_extra, "HOST_EXTRA" => $sibling_host_extra, "TIME_CHECKED" => ($sibling_has_times == 1) ? 'selected="' . $sibling_option_id . '" checked="true"' : '', "TIME_BLOCK" => $sibling_time_block ]);Someday, I hope the person who wrote this learn about methods and function calls. Maybe they could write their own one day.
In any case, here's the whole thing:
$resm_data = $data_source->fetchData("group=" . $item_id); foreach ($resm_data as $key => $value) { $option_id = $value->option_id; $resm_details = $detail_source->fetch($option_id); if ($resm_details) { $label = $resm_details->{"label$lang"}; $description = $resm_details->{"description$lang"}; $category = $resm_details->category; // Process cost based on category if ($category == 0) { $cost = $resm_details->{"cost" . $currency}; $child_cost = $resm_details->{"child_cost" . $currency}; $cost_info = $mot[101] . " : +" . number_format($cost, 2, ",", " ") . $currency_symbol . " - " . $mot[102] . " : +" . number_format($child_cost, 2, ",", " ") . $currency_symbol; } elseif ($category == 1) { $cost = $resm_details->{"cost" . $currency}; $child_cost = 0; $cost_info = $mot[101] . " : +" . number_format($cost, 2, ",", " ") . $currency_symbol; } elseif ($category == 2) { $cost = 0; $child_cost = $resm_details->{"child_cost" . $currency}; $cost_info = $mot[102] . " : +" . number_format($child_cost, 2, ",", " ") . $currency_symbol; } elseif ($category == 4) { $cost = $resm_details->{"cost" . $currency}; $child_cost = 0; $cost_info = $mot[500] . " : +" . number_format($cost, 2, ",", " ") . $currency_symbol; } elseif ( $resm_details->{"cost" . $currency} == 0 and $resm_details->{"child_cost" . $currency} == 0 ) { $cost = 0; $child_cost = 0; $cost_info = ""; } else { $cost = $resm_details->{"cost" . $currency}; $child_cost = 0; $cost_info = $mot[200] . " : +" . number_format($cost, 2, ",", " ") . $currency_symbol; } $location = $resm_details->location; $label_class = $location == 1 ? "has-quantity" : "no-quantity"; $action_class = $location == 1 ? "active-with-quantity" : "active-no-quantity"; if ($location == 1) { $quantity_block = '<div class="quantity-container"> <input type="text" value="1" id="quantity-' . $option_id . '" class="qty-control" name="quantity" min="1" max="1"> <div class="increase button">+</div> <div class="decrease button">-</div> </div>'; $quantity = 1; } else { $quantity_block = ""; $quantity = "all"; } $has_times = $resm_details->has_times; if ($has_times == 1) { $time_counter++; $time_data = json_decode($resm_details->time_data); $departure_select = '<option value="-1">' . $mot[300] . '</option>'; $arrival_select = '<option value="-1">' . $mot[301] . '</option>'; $departures = $time_data->departures; $arrivals = $time_data->arrivals; foreach ($departures as $dep_key => $departure) { $departure_select .= '<option value="' . $dep_key . '">' . $departure . '</option>'; } foreach ($arrivals as $arr_key => $arrival) { $arrival_select .= '<option value="' . $arr_key . '">' . $arrival . '</option>'; } $departure_block = '<div class="col-half time-select-' . $option_id . '" style="padding-right: 0;"> <select class="form-control time-departure" style="text-align: center;">' . $departure_select . '</select> </div>'; $arrival_block = '<div class="col-half time-select-' . $option_id . '" style="padding-left: 0;"> <select class="form-control time-arrival" style="text-align: center;">' . $arrival_select . '</select> </div>'; $time_block = '<div class="row time-container"> ' . $departure_block . $arrival_block . ' </div><small class="error-message time-error">' . $mot[302] . '</small>'; } else { $time_block = ''; } $host_cost_display = ""; $extra = $resm_details->extra; $host_extra = $resm_details->host_extra; $host_class = ""; if ($extra == 1) { $extra_cost_1 = $resm_details->{"cost" . $currency . "_1"}; $extra_cost_2 = $resm_details->{"cost" . $currency . "_2"}; $default_extra = $host_price == 0 ? $extra_cost_2 : $extra_cost_1; $cost_info = $mot[101] . ' : +<span class="extra-cost">' . number_format($default_extra, 2, ",", " ") . "</span>" . $currency_symbol . " - " . $mot[102] . ' : +<span class="child-cost">0.00</span>' . $currency_symbol; $host_class = " extra-option"; } if ($host_extra == 1) { $host_cost_display = '<span class="host-cost">' . $mot[500] . ' : +<span class="host-price">0.00</span>' . $currency_symbol . "</span><br>"; } // Add the main option to the template $TEMPLATE->SET_BLOCK_VARIABLES("Block_OPTIONS", [ "ID" => $option_id, "QUANTITY" => $quantity, "LABEL_CLASS" => $label_class, "ACTION_CLASS" => $action_class, "LABEL" => $label, "DESCRIPTION" => $description, "QUANTITY_BLOCK" => $quantity_block, "COST_INFO" => $cost_info, "HOST_COST_DISPLAY" => $host_cost_display, "COST" => $cost, "CHILD_COST" => $child_cost, "LOCATION" => $location, "CATEGORY" => $category, "HOST_CLASS" => $host_class, "EXTRA" => $extra, "HOST_EXTRA" => $host_extra, "TIME_CHECKED" => ($has_times == 1) ? 'selected="' . $option_id . '" checked="true"' : '', "TIME_BLOCK" => $time_block ]); $resm_children_data = $data_source->fetchData("parent=" . $option_id); foreach ($resm_children_data as $child_key => $child_value) { $child_option_id = $child_value->option_id; $resm_child_details = $detail_source->fetch($child_option_id); if ($resm_child_details) { $child_label = $resm_child_details->{"label$lang"}; $child_description = $resm_child_details->{"description$lang"}; $child_category = $resm_child_details->category; // Process cost for child category if ($child_category == 0) { $child_cost = $resm_child_details->{"cost" . $currency}; $child_extra_cost = $resm_child_details->{"child_cost" . $currency}; $child_cost_info = $mot[101] . " : +" . number_format($child_cost, 2, ",", " ") . $currency_symbol . " - " . $mot[102] . " : +" . number_format($child_extra_cost, 2, ",", " ") . $currency_symbol; } elseif ($child_category == 1) { $child_cost = $resm_child_details->{"cost" . $currency}; $child_extra_cost = 0; $child_cost_info = $mot[101] . " : +" . number_format($child_cost, 2, ",", " ") . $currency_symbol; } elseif ($child_category == 2) { $child_cost = 0; $child_extra_cost = $resm_child_details->{"child_cost" . $currency}; $child_cost_info = $mot[102] . " : +" . number_format($child_extra_cost, 2, ",", " ") . $currency_symbol; } elseif ($child_category == 4) { $child_cost = $resm_child_details->{"cost" . $currency}; $child_extra_cost = 0; $child_cost_info = $mot[500] . " : +" . number_format($child_cost, 2, ",", " ") . $currency_symbol; } elseif ( $resm_child_details->{"cost" . $currency} == 0 and $resm_child_details->{"child_cost" . $currency} == 0 ) { $child_cost = 0; $child_extra_cost = 0; $child_cost_info = ""; } else { $child_cost = $resm_child_details->{"cost" . $currency}; $child_extra_cost = 0; $child_cost_info = $mot[200] . " : +" . number_format($child_cost, 2, ",", " ") . $currency_symbol; } $child_location = $resm_child_details->location; $child_label_class = $child_location == 1 ? "has-quantity" : "no-quantity"; $child_action_class = $child_location == 1 ? "active-with-quantity" : "active-no-quantity"; if ($child_location == 1) { $child_quantity_block = '<div class="quantity-container"> <input type="text" value="1" id="child-quantity-' . $child_option_id . '" class="qty-control" name="quantity" min="1" max="1"> <div class="increase button">+</div> <div class="decrease button">-</div> </div>'; $child_quantity = 1; } else { $child_quantity_block = ""; $child_quantity = "all"; } $child_has_times = $resm_child_details->has_times; if ($child_has_times == 1) { $child_time_counter++; $child_time_data = json_decode($resm_child_details->time_data); $child_departure_select = '<option value="-1">' . $mot[300] . '</option>'; $child_arrival_select = '<option value="-1">' . $mot[301] . '</option>'; $child_departures = $child_time_data->departures; $child_arrivals = $child_time_data->arrivals; foreach ($child_departures as $child_dep_key => $child_departure) { $child_departure_select .= '<option value="' . $child_dep_key . '">' . $child_departure . '</option>'; } foreach ($child_arrivals as $child_arr_key => $child_arrival) { $child_arrival_select .= '<option value="' . $child_arr_key . '">' . $child_arrival . '</option>'; } $child_departure_block = '<div class="col-half time-select-' . $child_option_id . '" style="padding-right: 0;"> <select class="form-control time-departure" style="text-align: center;">' . $child_departure_select . '</select> </div>'; $child_arrival_block = '<div class="col-half time-select-' . $child_option_id . '" style="padding-left: 0;"> <select class="form-control time-arrival" style="text-align: center;">' . $child_arrival_select . '</select> </div>'; $child_time_block = '<div class="row time-container"> ' . $child_departure_block . $child_arrival_block . ' </div><small class="error-message time-error">' . $mot[302] . '</small>'; } else { $child_time_block = ''; } $child_host_cost_display = ""; $child_extra = $resm_child_details->extra; $child_host_extra = $resm_child_details->host_extra; $child_host_class = ""; if ($child_extra == 1) { $child_extra_cost_1 = $resm_child_details->{"cost" . $currency . "_1"}; $child_extra_cost_2 = $resm_child_details->{"cost" . $currency . "_2"}; $default_child_extra = $host_price == 0 ? $child_extra_cost_2 : $child_extra_cost_1; $child_cost_info = $mot[101] . ' : +<span class="extra-cost">' . number_format($default_child_extra, 2, ",", " ") . "</span>" . $currency_symbol . " - " . $mot[102] . ' : +<span class="child-cost">0.00</span>' . $currency_symbol; $child_host_class = " extra-option"; } if ($child_host_extra == 1) { $child_host_cost_display = '<span class="host-cost">' . $mot[500] . ' : +<span class="host-price">0.00</span>' . $currency_symbol . "</span><br>"; } // Add the child option to the template $TEMPLATE->SET_BLOCK_VARIABLES("Block_OPTIONS.Block_OPTIONS_CHILD", [ "ID" => $child_option_id, "QUANTITY" => $child_quantity, "LABEL_CLASS" => $child_label_class, "ACTION_CLASS" => $child_action_class, "LABEL" => $child_label, "DESCRIPTION" => $child_description, "QUANTITY_BLOCK" => $child_quantity_block, "COST_INFO" => $child_cost_info, "HOST_COST_DISPLAY" => $child_host_cost_display, "COST" => $child_cost, "CHILD_COST" => $child_extra_cost, "LOCATION" => $child_location, "CATEGORY" => $child_category, "HOST_CLASS" => $child_host_class, "EXTRA" => $child_extra, "HOST_EXTRA" => $child_host_extra, "TIME_CHECKED" => ($child_has_times == 1) ? 'selected="' . $child_option_id . '" checked="true"' : '', "TIME_BLOCK" => $child_time_block ]); $resm_sibling_data = $data_source->fetchData("parent=" . $parent_option_id); foreach ($resm_sibling_data as $sibling_key => $sibling_value) { $sibling_option_id = $sibling_value->option_id; $resm_sibling_details = $detail_source->fetch($sibling_option_id); if ($resm_sibling_details) { $sibling_label = $resm_sibling_details->{"label$lang"}; $sibling_description = $resm_sibling_details->{"description$lang"}; $sibling_category = $resm_sibling_details->category; // Process cost for sibling category if ($sibling_category == 0) { $sibling_cost = $resm_sibling_details->{"cost" . $currency}; $sibling_extra_cost = $resm_sibling_details->{"sibling_cost" . $currency}; $sibling_cost_info = $mot[101] . " : +" . number_format($sibling_cost, 2, ",", " ") . $currency_symbol . " - " . $mot[102] . " : +" . number_format($sibling_extra_cost, 2, ",", " ") . $currency_symbol; } elseif ($sibling_category == 1) { $sibling_cost = $resm_sibling_details->{"cost" . $currency}; $sibling_extra_cost = 0; $sibling_cost_info = $mot[101] . " : +" . number_format($sibling_cost, 2, ",", " ") . $currency_symbol; } elseif ($sibling_category == 2) { $sibling_cost = 0; $sibling_extra_cost = $resm_sibling_details->{"sibling_cost" . $currency}; $sibling_cost_info = $mot[102] . " : +" . number_format($sibling_extra_cost, 2, ",", " ") . $currency_symbol; } elseif ($sibling_category == 4) { $sibling_cost = $resm_sibling_details->{"cost" . $currency}; $sibling_extra_cost = 0; $sibling_cost_info = $mot[500] . " : +" . number_format($sibling_cost, 2, ",", " ") . $currency_symbol; } elseif ( $resm_sibling_details->{"cost" . $currency} == 0 and $resm_sibling_details->{"sibling_cost" . $currency} == 0 ) { $sibling_cost = 0; $sibling_extra_cost = 0; $sibling_cost_info = ""; } else { $sibling_cost = $resm_sibling_details->{"cost" . $currency}; $sibling_extra_cost = 0; $sibling_cost_info = $mot[200] . " : +" . number_format($sibling_cost, 2, ",", " ") . $currency_symbol; } $sibling_location = $resm_sibling_details->location; $sibling_label_class = $sibling_location == 1 ? "has-quantity" : "no-quantity"; $sibling_action_class = $sibling_location == 1 ? "active-with-quantity" : "active-no-quantity"; if ($sibling_location == 1) { $sibling_quantity_block = '<div class="quantity-container"> <input type="text" value="1" id="sibling-quantity-' . $sibling_option_id . '" class="qty-control" name="quantity" min="1" max="1"> <div class="increase button">+</div> <div class="decrease button">-</div> </div>'; $sibling_quantity = 1; } else { $sibling_quantity_block = ""; $sibling_quantity = "all"; } $sibling_has_times = $resm_sibling_details->has_times; if ($sibling_has_times == 1) { $sibling_time_counter++; $sibling_time_data = json_decode($resm_sibling_details->time_data); $sibling_departure_select = '<option value="-1">' . $mot[300] . '</option>'; $sibling_arrival_select = '<option value="-1">' . $mot[301] . '</option>'; $sibling_departures = $sibling_time_data->departures; $sibling_arrivals = $sibling_time_data->arrivals; foreach ($sibling_departures as $sibling_dep_key => $sibling_departure) { $sibling_departure_select .= '<option value="' . $sibling_dep_key . '">' . $sibling_departure . '</option>'; } foreach ($sibling_arrivals as $sibling_arr_key => $sibling_arrival) { $sibling_arrival_select .= '<option value="' . $sibling_arr_key . '">' . $sibling_arrival . '</option>'; } $sibling_departure_block = '<div class="col-half time-select-' . $sibling_option_id . '" style="padding-right: 0;"> <select class="form-control time-departure" style="text-align: center;">' . $sibling_departure_select . '</select> </div>'; $sibling_arrival_block = '<div class="col-half time-select-' . $sibling_option_id . '" style="padding-left: 0;"> <select class="form-control time-arrival" style="text-align: center;">' . $sibling_arrival_select . '</select> </div>'; $sibling_time_block = '<div class="row time-container"> ' . $sibling_departure_block . $sibling_arrival_block . ' </div><small class="error-message time-error">' . $mot[302] . '</small>'; } else { $sibling_time_block = ''; } $sibling_host_cost_display = ""; $sibling_extra = $resm_sibling_details->extra; $sibling_host_extra = $resm_sibling_details->host_extra; $sibling_host_class = ""; if ($sibling_extra == 1) { $sibling_extra_cost_1 = $resm_sibling_details->{"cost" . $currency . "_1"}; $sibling_extra_cost_2 = $resm_sibling_details->{"cost" . $currency . "_2"}; $default_sibling_extra = $host_price == 0 ? $sibling_extra_cost_2 : $sibling_extra_cost_1; $sibling_cost_info = $mot[101] . ' : +<span class="extra-cost">' . number_format($default_sibling_extra, 2, ",", " ") . "</span>" . $currency_symbol . " - " . $mot[102] . ' : +<span class="sibling-cost">0.00</span>' . $currency_symbol; $sibling_host_class = " extra-option"; } if ($sibling_host_extra == 1) { $sibling_host_cost_display = '<span class="host-cost">' . $mot[500] . ' : +<span class="host-price">0.00</span>' . $currency_symbol . "</span><br>"; } // Add the sibling option to the template $TEMPLATE->SET_BLOCK_VARIABLES("Block_OPTIONS.Block_OPTIONS_CHILD", [ "ID" => $sibling_option_id, "QUANTITY" => $sibling_quantity, "LABEL_CLASS" => $sibling_label_class, "ACTION_CLASS" => $sibling_action_class, "LABEL" => $sibling_label, "DESCRIPTION" => $sibling_description, "QUANTITY_BLOCK" => $sibling_quantity_block, "COST_INFO" => $sibling_cost_info, "HOST_COST_DISPLAY" => $sibling_host_cost_display, "COST" => $sibling_cost, "SIBLING_COST" => $sibling_extra_cost, "LOCATION" => $sibling_location, "CATEGORY" => $sibling_category, "HOST_CLASS" => $sibling_host_class, "EXTRA" => $sibling_extra, "HOST_EXTRA" => $sibling_host_extra, "TIME_CHECKED" => ($sibling_has_times == 1) ? 'selected="' . $sibling_option_id . '" checked="true"' : '', "TIME_BLOCK" => $sibling_time_block ]); } } } } } } .comment { border: none; }CodeSOD: Lock 'Em Dead
Kevin sends us an exception handler from C++. Let's see if we can spot what's going wrong:
catch (Exception::Deadlock) { retry; }When we catch a deadlock happening, we retry. That's not a keyword in C++, and looking at how it's used, it has to be some kind of macro, and I suspect that the macro is hiding a goto underneath it.
The real problem, though, is that we suspect we're in a deadlock situation. That means this thread is waiting on a resource held by another thread which is waiting for a resource held by this thread. Neither train may continue until the other has passed. So this retry only works if it releases the resource held by this thread (letting the deadlocking thread proceed). But does it?
Not according ot Kevin. The code already had a pile of deadlocks in it, so they brought in a highly paid consultant to try and fix them by reordering access and tracing where mutexes were causing issues. This retry just jumps back up to the top of the block, without releasing any resources. It "seems the consultant wanted to add some deadlocks of their own," Kevin says.
Representative Line: Both Ways Bug Me
There are many cases where some sort of debugging block sneaks by, especially cases where we see preprocessors or templates working, which leave us with nonsense like if (true == false) running in production. But Codemonkey found a new twist on that sort of thing, in a SQL query being run in production.
WHERE (some conditions) AND (1 = 0 OR (1 = 1 AND (other conditions)))The OR means that by twiddling the first equality check, we can toggle "always return rows" with "return based on condition". Toggling the second we can make it "never return rows", which I'm not certain is actually useful. I can see how these likely did start life as debugging flags, but they're still weird, still unnatural. They point to some other problem in observability in the code. And, as all "good" flags go, they're not documented anywhere, this seems like it started life as a query an analyst was running until it got turned into stored procedure to be run again and again. The flags have never been changed since the code was released, as far as anyone can tell.
[Advertisement] Plan Your .NET 9 Migration with ConfidenceYour journey to .NET 9 is more than just one decision.Avoid migration migraines with the advice in this free guide. Download Free Guide Now!
RCE As a Feature
The opposite of meritocracy is kakistocracy: the worst and least-qualified are the ones who rise to the top.
Get real familiar with that word, dear readers. I think you'll need it.
If anyone can back me up on this, it's our submitter, Jared B:
I am a teacher by profession, and worked for a year at an ed-tech company founded by a mechanical engineering professor, Harry. Harry had spent a great deal of time in the 90's developing a C interpreter (yes, you read that right). 30 years later, he remained convinced that his interpreter was the technology of the future, and had founded a company that offered math and computer science curriculum to K-12 students based on C programming.
Originally, he had written a textbook that introduced students to programming using a locally-installed version of his interpreter and custom IDE. A little vain, but no serious problems. As Chromebooks grew popular in schools, he had developed a web IDE where students could write and run C code.
But Harry could never give fully give up on the Windows IDE for his C interpreter. So, he included in the web version a "Run Locally" button for those school computers still running Windows. It worked like so: installing the interpreter and IDE locally would also install a daemon that activated on startup and ran a websocket server. This server had an endpoint which accepted as a parameter a string of C code. It would then pass this C code to the locally-installed interpreter to run.
As you might suspect, there was no authentication whatsoever on this local websocket server. Knowing the form of the protocol, ANY domain could connect to localhost:12345/execute_c_program and send arbitrary code to run (of course, Harry prided himself on the completeness of his C implementation, including execv() and the like). Trick a user into visiting a malicious website, and you automatically had RCE on their computer.
Adding insult to injury, I discovered that the server was bound to 0.0.0.0 so that if you had Harry's software (/malware) installed, any computer on the same network as you could send you arbitrary C code to execute without question.
These vulnerabilities had existed for several years before I joined the company. In all that time, Harry had never hired anybody but his own grad students as software developers, and none of them had noticed the problem. By that time, the software was installed on thousands of school-owned computers throughout the state.
I documented and demonstrated the vulnerabilities to Harry. He did release a new version of the software addressing the issues and citing "security improvements" in the release notes, but there was never a communication to school/district IT leaders to describe the importance of updating. I suspect that Harry should be in serious legal trouble for potentially compromising data related to schools and minors, but I've since moved on and dropped the subject.
During the year I spent at the company (not in any sense as a dev, mind you, but as a lowly curriculum writer), I also discovered and reported a cookie-stealing exploit that would have compromised student and teacher data, as well as a code injection on another of Harry's websites (he decided to demonstrate that his C interpreter could work as a web server via a page where a user could type a math expression, which was then eval()ed server-side without any sanitation). The latter vulnerability gave me remote access, where I discovered thousands of transaction records that included credit card information stored in the clear.
Harry's company is still in business to this day, and has recently been ranked in TIME's list of top American ed-tech companies. Oh, and the office router's admin page still had the default Google-able username and password, but that one's a freebie.
I knew someone like this once, only they were stuck on ColdFusion long after everyone else stopped caring about it. However, I don't think they went on to endanger an entire state's educational system, only to be lauded as a visionary leader. Can't say for sure, though.
Error'd: Failure, After Failure, After Failure...
We have a couple from Foo (AKA Foo) today, include a special text copy-paste
Foo shared "I know you usually post image WTFs here, but here's a text output from chromium:
[...:ERROR:components/viz/service/display/display.cc:273] Frame latency is negative: -0.18 ms
While this issue might be fixed by now, at least on some platforms, I think it's remarkable that someone actually wrote this message without wondering if it ever makes sense ...And also commented "I visited Spain to see the eclipse (which was great BTW). I had heard that temperature may drop during totality, but was surprised by how much." Negative Infinity!
"Youfailedatmathtube" muttered dragoncoder047, snarking only "Title."
"Hello to you too, New Mexico!" enthused Chris A. "Setting up web sites is hard. The DOT got bored half way through and just left the rest of the buttons as they were."
Finally, "Failure Fail" from Basti "Did I succeed or did I fail? Is my whole life a success? Or a failure? I'm confused. You can find this here.
Representative Line: We All Register This
Today's maybe more of a "representative data sheet entry" than anything else.
Every developer has the experience of reading the documentation. If you've been at this for some time, you've probably read bad documentation. Documentation that is incomplete, inaccurate, or otherwise flawed. Or, my personal favorite, the brief time where Oracle tried to put all of its documentation into an Adobe Flex site (aka, a Flash application, not a real web app). That one had fun bonus features, like "breaking copy and paste" and "preventing you from deep linking to a piece of the documentation".
But software documentation has got nothing on bad data sheets. When you buy an integrated chip from a vendor, whether it's a microcontroller that'll run your code, a sensor you're trying to get data from, you're at the mercy of the datasheet for understanding how it works. Sometimes, even finding an English language datasheet can be a challenge. The more complex the chip you're trying to interact with, the more complex the datasheet needs to be, and at a certain point, a lot of vendors say, "meh, you'll figure it out." I've had chips where the datasheet and reality disagreed about what registers were available, which often means that core functions of the chip require twiddling undocumented registers. For more fun, they sometimes lie about which pins on the chip do which thing, including mislabeling which pins handle power. There's nothing more fun than the tiny little "pop" of a chip dying when you throw 5V power onto a pin that's actually ground.
Now, there are some vendors, and some products, where the datasheets are pretty solid. This isn't a universal problem, but when you're working in an embedded space, "cheapest" is frequently the main criteria for picking components, and "cheapest" means "worst documented".
Which brings us to Jarek's recent experience going through a data sheet. The chip in question had a "fantastic feature" that would change how debugging worked, which was for "super users" to enable by setting a register.
3.2.4 Super User Fantastic Feature Enable Register The Super User Fantastic Feature Enable Register allows the user to modify the behavior of the mEDBG. Name: SUFFER Offset: 0x0120 Reset: 0xFFSometimes, doing embedded work definitely feels like the SUFFER register is set.
[Advertisement] Picking up NuGet is easy. Getting good at it takes time. Download our guide to learn the best practice of NuGet for the Enterprise.CodeSOD: Back to the Lab
Matlab is special. Scientists and researchers love it. Programmers hate it, and not just because it uses 1-based arrays. I've worked on a number of projects where the task was "take this Matlab code and convert it to C so we can run it on an embedded CPU". Somehow, in that process, I've avoided learning much about Matlab.
Andre works on a team that uses Matlab to manage experimental scenarios. They wanted to do a simple task: generate a set of participant-specific images, store them in a database, and reference them later. Somewhere in the intersection of the database product they were using, the Matlab license they had, and other constraints, they discovered that there simply was no good way to do this.
Enter "Jude". Jude said, "Don't worry about it, I can hack something together."
I present the code in its entirety, but don't ask me to explain it. Instead, read the comments.
nMk = 1;%counting non-response triggers, this cycles with each trial nPress = 0;%counting button presses, noting the position in the log for v = 1:height(resVmrk)%read each trigger switch nMk %it's kinda roundabout, but the only recognisable part is the response %yet I refer to it only by elision %and instead count the stimuli to reconstruct the pattern case 1%an almost reliable stimulus nPress = nPress+1;%trial start if strcmp(resVmrk.TriggerCode{v},'S1')%it must be a non-response resVmrk.TriggerCode{v} = 'cross';%name it properly nMk = 2;%and expect the next one else%except when it is not resLog.miss(nPress) = 1;%then note it down as missed nMk = 0;%and skip to response end case 2%usually reliable if strcmp(resVmrk.TriggerCode{v},'S1')%if the face loaded successfully resVmrk.TriggerCode{v} = 'face';%note it nMk = 3;%and proceed accordingly if nPress<=height(resLog)%trailing triggers at the end should be ignored resLog.facePos(nPress) = v;%note the position end else%if it failed to load it is a response resVmrk.Dur(v-1:v+1) = 0;%mark the whole trial for deletion resLog.miss(nPress) = 1;%and note it down as missing the face nMk = 0;%and skip to response end case 3%this one is not reliable, and sometimes is duplicated instead of missing if strcmp(resVmrk.TriggerCode{v},'S1')%if it is present at all resVmrk.TriggerCode{v} = 'empty';%first name it if v<height(resVmrk)%if it is not a trailing trigger, since it'll break the check otherwise if ~strcmp(resVmrk.TriggerCode{v+1},'S1')%if the next trigger is a response nMk = 0;%all is fine and it didn't freak out, proceed to response else%otherwise nMk = 3;%just treat as a double %and then count how many excess triggers are actually here nExcess = 1;%definitely one here already while strcmp(resVmrk.TriggerCode{v+nExcess+1},'S1') nExcess = nExcess+1;%and everything until the response end resVmrk.Dur(v-2:v+nExcess+2) = 0;%then mark the whole trial for deletion %this overwrites the same positions several time, but the important part is to get the preceding two, because I don't know which one of them is correct one, so I delete the whole trial if nPress<=height(resLog) resLog.bad(nPress) = 1;%also note it down as borked end end end else nMk = 0;%if it didn't happen at all simply proceed to response end case 0%this one reliably follows the response, so I address the response by elision if strcmp(resVmrk.TriggerCode{v},'S1')%skip response itself resVmrk.TriggerCode{v} = 'blink';%note the only reliable non-response (always following the response) nMk = 1;%start the trial anew if nPress<=height(resLog)%if it is not a trailing trigger resLog.respPos(nPress) = v-1;%note down the response position if resLog.miss(nPress)==1%and if it's a response without a stimulus resVmrk.Dur(v-1:v) = 0;%mark it for deletion as well end end end end endAh, the classic "for-case" antipattern. That's gross enough, but what the heck is happening inside each of those cases?
My personal favorite comment is this one: "%this overwrites the same positions several time, but the important part is to get the preceding two, because I don't know which one of them is correct one, so I delete the whole trial"
Now, you may suspect comments like "usually reliable" are about what we see in the dataset, but I'm not so certain. Andre writes:
After reverting the last discovered way for his creation to corrupt the data I was able to figure out that 20% of the logs provided corresponded to different (unknown) experiments altogether.
.comment { border: none; }Floating Along
Today's submitter John F. was migrating data from a Microsoft platform to a Microsoft platform, using Microsoft tools. Absolutely nothing could go wrong, right?
Right?
A few years ago, I was working on a migration. We had sold part of our business, and so we had to extract a whole bunch of customer documents and metadata to provide to the buyer. The documents were stored in SharePoint on-premises, so the first step was extracting the metadata and storing it in a SQL Server database.
A colleague had used Microsoft's ETL tool SSIS to get the process started, and it generated a database schema. But after taking over, I wanted to change to PowerShell for greater control. For speed reasons, I decided to use System.Data.SqlClient.SqlBulkCopy, and getting that going required making sure my PowerShell script had all the correct data types.
One of our fields was the customer number. Customer numbers were up to 10 digits, but the first two were usually 0. Now, I prefer storing customer numbers as text, but someone in the distant past thought, This is a number, and SharePoint has a Number field, so I will use that.
Under the hood, Number fields in SharePoint are actually Doubles. Using a Double to store something exact like a customer number is not really ideal, but double-precision is absolutely enough to represent 10 digit numbers accurately. So what went wrong?
Well, remember we used SSIS to create the original table schema in SQL Server. I then used this table schema to write my script. But it turns out that in SQL Server world, the double-precision type is called float. If you want single-precision, you have to say float(24). I didn't know this, and so when I saw the SQL Server column as a float, I entered float as the corresponding .Net type in my script.
Oops.
So numbers came out of SharePoint as double. They were then converted to float before being inserted into SQL Server. Almost all records were fine, but large customer numbers had their last few digits changed. Testers didn't notice, but fortunately someone picked it up in the full load. We had to generate a list of changed numbers to patch the data after the fact.
The State of Ticketing
Developing software can't simply be done with a text editor and a compiler. There are a variety of other tools we have to bring to bear that support our efforts and keep the team organized, like say, source control.
There are certain tools we all have to use that I would argue, nobody has actually make a version that's any good. Build tooling is one of my go-to examples: there are no good build systems, only build systems that are good enough for this task.
Another is ticket/task management. In fact, I'd go so far as to say, there are no good ticket management tools. Amongst the not good tools, I'd put Jira as one of the not goodest of all.
What makes Jira attractive to companies is the same thing that makes it miserable, and the thing that infects any "enterprise" software platform and turns it into garbage: it has all the features and expect you to build your own workflows with it. You don't merely use Jira, you have to program your own interfaces in Jira to get your workflow into the system. And if you have the misfortune to have a project manager who thinks they're more technical than they are, they'll endlessly spin up new views, new workflows, and rearrange how the work is tracked in lieu of actually working.
I've been on that team.
One of Jira's features is the ability to describe the ticket workflow: the state machine that describes your process from the initial entry of the ticket all the way down to released software or project completion. This includes routing, so that as one team member does their part of the work, it automatically goes to someone else to do the next portion of the work.
Which brings us to Klinsten. They were working on a new team, and wanted to change the ticket status from its current status to whatever came next in the workflow. So they looked at the workflow.
These are two different versions of the same workflow, one with transition labels added, which as you can see, does nothing to clarify the workflow. That it's a mix of Dutch and English doesn't help matters.
The purpose of this workflow is to help the team understand how to sequence and organize their work. But this workflow has so many states and so many transitions, it fails at this goal. Looking at it makes me just want to gesloten my browser tab, because this user isn't accepting any of this.
Error'd: Zero to Zero in 0 seconds
"So many zeroes! I'm in." W00H000! Kivi S. "found this ad in the wild. This must be a very large jackpot, look at all those zeroes!"
"I knew it!" groused an anonymous cynic. "Yes, SignUpGenius. We all know that SUCCESS is just an illusion."
Another anonymous grouch reported "I guess JustWatch has suddenly become a bit precious about their sources"
"These boots are made for crashing" thundered Michael R. "PII of the developer have been removed to protect the not so innocent." You can't hide PHP so easily.
And again from prolific Michael R. "El Reg has been around for 30+ years and their code should be mature. I wonder about their SQL which seems to randomly return duplicate records. https://www.theregister.com/week". I'll be happy when Errord shows up on El Reg. Ok, no I won't but I'll at least be grouchy differently.
CodeSOD: Never Eating the Cookie
Maciej works as a freelancer, and that frequently means picking up old PHP code that nobody wants to support.
One project had been lingering for ages with key features missing. Specifically, it was supposed to make HTTP requests to other services on an interval, and use that to populate its data. "The old dev tried, but never got it working." It was Maciej's turn to give it a shot.
$ch = curl_init( $url ); curl_setopt( $ch, CURLOPT_COOKIEFILE, $cookie ); curl_setopt( $ch, CURLOPT_COOKIEJAR, $cookie ); curl_setopt( $ch, CURLOPT_COOKIE, $cookie); // ... many other options set, of course not in a function, just copy-pasted in many locations in the code ... curl_setopt( $ch, CURLOPT_TIMEOUT, $interval ); $s = curl_exec( $ch ); curl_close( $ch );This particular block of code appeared multiple times in the code. Every place they meant to send an HTTP request, they copy/pasted this code in. The URL would be a different value, but the bulk of the code was just a dozen lines of copy/pasted curl_setopts.
Now, I don't know that they were dreaming that setting CURLOPT_TIMEOUT was setting a recurrence interval. But they do call the value $interval, and I can imagine the ignorant hoping to set up cURL to automatically reinvoke the request on an interval. But even if that's their goal, that's not the actual problem with this code.
They initialize a cURL wrapper, set a pile of options, and then execute the request, storing the result in $s. And do you know what they do with the contents of $s after this?
Nothing.
The request works, perhaps not on an interval, and populates the variable, and they just never use it. The old dev "tried" and never got it working? It seems like they started and got bored.
There was far worse spaghetti code to manage in the project, but it was this gap that really got Maciej's attention.
.comment { border: none; }Branching Paths
"You submitted a pull request."
Indika was, in fact, reviewing the comments she'd gotten on that very same pull request, when her boss, Bill, walked up behind her. What she didn't understand is why Bill said it like it was an accusation.
"Yes?" she replied.
"Okay, well, we don't do that here. You're new, so I'll let it slide, but please review the developer guide."
Well, Indika had reviewed the developer guide, or at least thought she had. As it turned out, there was the official, company wide developer guide. That's the one she'd read. But Bill maintained his own, for his team. He hadn't ever told her about it, but apparently assumed she'd have the oracular blessings of Apollo and find it by herself.
It had this to say:
Branching is prohibited. Merging is a time wasting activity and goes against CI principles. Only use git to commit, push, and pull.
And rebase, presumably, if everyone was just committing on the main branch?
Indika asked one of her co-workers, Elise, over coffee: "Is this real?"
"Yeah," Elise said. "I'm not sure how he found out about your PR, I don't think anybody added him to the review. I mean, why would they?"
"Oh, I sent him the link," Indika said. "Just a whole, 'I'm new here, look at me doing the work!' type heads up."
"Oh yeah, definitely don't do that."
"So we do use PRs?"
Elise nodded. "Of course we do. We're not crazy. We just make sure Bill never finds out."
That seemed like a terrible way to work, but Indika went along with it, at least for a few weeks. Then an opportunity presented itself; she and Bill bumped into each other in the kitchenette grabbing coffee, and nobody else was around. At this point, Indika had already submitted a number of PRs without Bill knowing.
"Bill, I've been meaning to ask, what's your rationale for prohibiting branching?"
Bill loved being asked that question. "Well, well, it comes from twenty years of experience. What exactly does a branch get you?"
"A distinct history of changes that can be maintained and eventually merged in once a large unit of work has been done without disrupting other work that might be in flight?"
"Another point of conflict! A chance for the code you're working on to get stale. A chance to fall behind the rest of the team. Now, for a large open source team, with a lot of collaborators, a branch might make sense. I'm skeptical, but I can at least understand it. But for our internal team? It's just developers seeing a new toy and going, 'oh, shiny!'"
Indika sipped her coffee and went back to her desk. She was fortunate to have a window nearby, and looked at the squirrels playing in the branches of the tree.
[Advertisement] Plan Your .NET 9 Migration with ConfidenceYour journey to .NET 9 is more than just one decision.Avoid migration migraines with the advice in this free guide. Download Free Guide Now!
CodeSOD: Public Private Partnership
Eric O was trawling through an API for handling concurrency, and found this little mismatch between the comment and the definition:
/// <summary> /// private Status, because while this object needs to be able to set the status, consumers should only be able to check it, lest everything break. /// </summary> public StatusType Status { get { return _status; } set { if (value != _status) { RaisePropertyChanged("Status"); } } }It's very important we make this property private, lest clients abuse it, and unleash dragons, chaos, and other potential horrors. Given that this happens inside of a concurrency API, I can only imagine what could go wrong when you mess this up. So sure, the comment makes sense.
The definition on the other hand, doesn't agree.
In practice, it's probably fine to do it this way, and at least the comment will show up in the documentation. If a consumer of the API misbehaves, they'll at least see that the docs suggest this is private.
The joke, of course, is the idea that the users of the API are going to read the docs, or care that one of the public methods suggests that it should be private.
.comment { border: none; } [Advertisement] Picking up NuGet is easy. Getting good at it takes time. Download our guide to learn the best practice of NuGet for the Enterprise.The Crossroads
-Leila
For a while I was stunned, staring at the email in front of me. I’d just told my boss I was quitting, refusing a promotion into my recently-deceased mentor Aggie’s shoes. Now, the new head of Human Resources wanted to see me.
Me? A Tech Support drone with one foot out the door? Well, she didn’t know that yet, did she?
Something in me feared where this might lead. But, Leila had stuck her neck out to rescue me from CEO Gibbs. She seemed like she cared about making things better. I decided to hear her out. Figured I owed her that much before I blew outta there for good in two weeks.
I had way too many hours to kill. Between whittling down my overstuffed inbox and resuming casework, it should’ve been easy to distract myself, but I couldn't focus on a single thing. I’d just done what had once seemed impossible. My brain wasn’t letting go of that any time soon.
Megan and Reynaldo also handed in their resignations. I got their messages confirming as much. We met up for lunch at a nearby restaurant and celebrated, but I was distracted. Amid the smiles and positive energy, the meeting with Leila was all I could think about. Should I mention it? I decided not to, not until I knew more.
I dreaded the afternoon slog now more than ever, but somehow, it slogged. When the clock’s hands finally crawled to 3:30, I threw on my coat and hat and darted out for one last smoke break. Then, it was time for C-Town.
Consumed with nervous energy, I shunned the elevator to race up the stairs floor by floor. Figured I’d burn off some stress, which could only help with whatever came next. Also figured I’d have a minute to recover in the vast executive lobby before finding my way to her office. Instead, I found Leila standing right there, every bit as polished as our surroundings. She faced me with surprise. “Hello.”
I tried to speak, laugh, something. Instead, I doubled over, coughing and gasping for air that felt all too thin up in nosebleed territory. While recovering, I couldn’t help but notice the gleaming tile beneath my feet, contrasting against my work shoes encrusted with sidewalk salt. Such details seldom crossed my mind, but the sort of people who worked up there lived and died for such details. Face flush, I cleared my throat one more time and righted myself, looking her way. “’Scuse me.”
“That was a long way up,” Leila remarked, gesturing behind herself. “I thought we could visit the observation deck. Would you like something to eat or drink first?”
Truth be told, I was already dying for another smoke. “No, that’s all right.”
“Follow me.”
She led the way through massive, quiet corridors to a small room with glass walls and ceiling. At this height, all one could see outside was a thick lead wall of fog. Leila strayed up to the far wall, a jewel against the void, and glanced back over her shoulder with chagrin. “I’m sorry, the view’s not very good today.”
“I dunno, I kinda like it.” Something about foggy weather had always intrigued me. With the normal world gone, it seemed like anything could happen.
She beckoned me closer with one hand. I strayed up next to her right side, staring out at the shrouded view.
“I understand you and Agatha Shaw were close,” Leila began quietly. “You have my deepest condolences.”
A two-ton anvil crashed onto my nerves. My fists clenched up at my sides. I worked so hard to hold back the flash-flood of grief that I couldn’t string words together. I only trusted myself to nod.
She glanced my way, hesitating. “Would it be better if we rescheduled?”
“I’m here,” I forced out. “Whatever you have to say, say it.”
She nodded. “First: while you were out of the office, I asked Francis Bronson to hand in his resignation.”
I drew a blank on the name, and blinked her way in confusion.
“The manager who nearly destroyed a printer with his hair dryer,” Leila explained, “after I’d just made a company-wide push for everyone to respect our office equipment.”
“Oh. Hothead!” My nickname for the guy. I’d worked that case a few weeks ago, but it felt more like years. Hothead worked in HR—at least, he had. After disarming him, I’d sent Leila an email, appealing for help against someone who clearly shouldn’t have been managing a supply cabinet, much less human beings. Well, she’d delivered. A warm note of satisfaction offered me a welcome lift out of grief. “Thanks. Really.”
Leila smiled. “We make a good team, I think. Which brings me to the other thing I wanted to discuss. Something new.”
My gaze fastened onto hers with a mix of intrigue and dread.
“You and I both know how badly this place needs to change. Let’s work together and actually fix things. I want to create a Change Management team and make you Team Lead.”
I was speechless, caught completely off-guard.
“The first thing we’d do is attack our company-wide leadership problem. Audits, surveys, hearings … eventually, a reorg. Along with simplifying the corporate structure, we’ll get rid of all the—Hothead, you called him? All the other Hotheads.”
“The biggest hothead is sitting at the top of the whole rotten pyramid,” I blurted. “He ain’t budging. He ain’t signing off on this, either!”
Leila was unfazed. “I think we could frame everything in a way that makes Mr. Gibbs like it. After all, we’re reducing payroll. We’re better positioning ourselves in a tough economic time. Worst-case, we could always use the three magic words: Google Did It.” She smirked.
I couldn’t help smirking back. Then I remembered what I’d done just a few hours earlier. “But I’m outta here. I quit! Put in my notice this morning!”
Leila nodded calmly. “Do you have a new position lined up somewhere else?”
“No. I'm going freelance with friends.”
“Friends who are leaving the company along with you?”
I nodded.
She paused for thought. “If you were to lead my Change Management team instead, you’d be able to recruit internally for your team. Whoever you think would be the most helpful. You’d set the agenda for whatever’s most important to address so that other good people don’t feel like they have to get away from here. All of this would mean a promotion to Director, with a salary and benefits to go with. And if you need more bereavement time, I could arrange an indefinite leave of absence until you feel ready to come back.”
The breath died in my throat. Had I suffered a stroke? I must’ve had a stroke. No, she really said it. She was on the level. I could change things. I could hire my friends to help me do it. A raise, full bennies, working with her every day?
Only a fool would refuse. And yet, my gut ached at the idea.
I stood there, frozen and mute, until I remembered something in my trench coat pocket: RD, the rubber duck I’d miraculously rescued from Aggie’s former office. I reached into my pocket and seized him in my fist.
RD? Aggie? I thought. Whoever’s listening. It all sounds amazing. I know she means it. But … it’s another trap, isn’t it? Staying in this joint for any reason means betraying myself. Betraying everything.
“Listen,” I finally said, “I’m flattered you even offered, but it ain’t right for me. Don’t give up on your idea! I’ve got friends here with ideas of their own for changing things. 32-hour work weeks. The end of free overtime. A union. I’ll send ’em your way. Offer them a spot on your team.”
Leila sighed. “A union would be an especially tough sell to Mr. Gibbs, but that really is a case where Google Did It. We might scare him so much with that idea that everything else would seem harmless in comparison.” She faced me with a sad smile. “A shame that we’re losing you. I was starting to learn some interesting things about printers.”
I’d miss her, too. And yet, I was feeling surprisingly great about my refusal.
“Make sure you file for unemployment,” she said. “We won’t stand in your way.”
I offered my hand. “Thanks for everything, Leila. Whenever it is they kick you outta here for good, come find me.”
She shook, sad smile persisting. “Maybe I will.”
I told Megan and Reynaldo about the new Change Management team. Made sure they knew the offer was on the table in case they preferred that over jumping ship. Both were quick to say no. Like me, they were too excited about our plans to stop now.
For the next couple of weeks, there was still plenty of work to be done: transferring my open tickets to other support reps and all that. But there was barely any time for it. Coworker after coworker stopped by my cube to express their surprise and wish me well in whatever came next.
“You’ll never be problem-free,” one of them advised me. “Go looking for the problems you want to have.”
I felt happier, freer, more determined than I had in ages. It was the conviction of knowing I’d stuck to my guns to do the right thing for myself.
Sanjay also jumped ship to join us. And there was one last surprise that came in the form of a phone call. The name on my work phone’s caller ID was DRACORA, P. So-called “Dracula!” Having a fairer opinion of her than most, I picked up without any sense of dread.
So-called “Dracula!” She hadn’t been so bad at all. Surprised, I picked up in a hurry.
“I’m so sad to hear you’re leaving!” she said. “What kind of freelance work are you doing?”
“All sorts of IT projects,” I replied. “Maybe some consulting on the side.”
“I have a friend who needs help setting up a website for her business. Is that something you could help her with?”
My eyes flew wide open in shock. “Sure!”
“I’ll put you in touch with one another.”
“That’d be swell. Thanks!”
We exchanged contact info. She promised to keep pointing friends our way whenever she could.
On my last day, I sent my personal contact information to my coworkers. I reminded them of Leila’s offer and urged them to keep me posted on their different causes. Then my friends and I walked out of a building that no longer had a hold over any of us.
It felt pretty damn swell.
Our accountant helped us incorporate RD IT Solutions. Only close friends knew it stood for “rubber duck.” The company covered medical and other relevant expenses for everyone. There was no hierarchy. Everyone had equal financial stakes and an equal say in company decisions.
After decades of being an expert at what I did, I was back at square one, learning the ropes. So much of what we had to learn for our business could only be learned through failure. Still, it felt rewarding to challenge my brain in new ways. The new gig let me wear lots of hats, from tech support to coding to business admin.
With no more regular paychecks, we had to tighten down our finances to what was critically important. We worked remotely at whatever times worked best for us, with the occasional meet-up at a public place or someone’s home. We all knew that any one of us having some kind of trouble could count on the rest of the group to help out as best as they could.
Megan quit smoking again. I cut way back myself. Wasn’t trying to, I just haven’t felt the need as much. Also stopped having those nightmares. It no longer feels like I’m living just for time off and weekends. I don’t spend my Sunday nights dreading Monday.
Dracula really did introduce us to our first client. It’s crazy what the universe puts out there when you go looking for it.
We met up remotely for our first client meeting to discuss requirements and expectations. When the topic of deliverables came up, our client scrunched her nose and interrupted Megan mid-sentence. “I don’t trust email! I’d rather you fax me the files.”
We were building a website for her.
“You mean, the source files?” Megan soldiered on bravely.
“Just fax me the codes,” the client said. “My nephew can re-type them into the Internet.”
She provided a fax number, fully expecting us to print out several hundred lines of code to send over. After deploying our first stab at a website that met her requirements, we did just that, mostly out of curiosity.
A few days later, she called us in a huff, saying her website looked like random letters. Her nephew had typed the code into Facebook.
FIN