The Daily WTF

Venkat joined a new team in the middle of a big refactoring effort. The code was quite a mess, glued together by long Python scripts with main functions longer than a Tolstoy novel. It was this effort to clean up the code into neat modules that highlighted some logical issues with their implementation.

def generate_random_number(): """ Generate a 5 digit random number. """ return "".join(map(str, random.sample(range(0,10),5)))

The script this function comes from is a launcher script that provisions a VM to execute code. The VM needs a unique identifier, and we get that random number this way.

The random.sample function, in Python, samples a population without replacement. So here, we pass it a range of 0-10 (which is 0-9 inclusive), and ask for five random entries from it. Again, without replacement, so a range that could concievably contain up to 100,000 possible values is significantly constrained down to 30,000 or so- only the numbers less than 100,000 that contain no duplicate digits.

We then map the resulting array into an array of strings, then join that into a final output string.

Now, for most of us, I do suspect that 30,240 unique values is probably enough for how ever many VMs we might need to reserve at any one time; if you're not working for Amazon or Google or whatever, you're probably fine. Then again, the chances of an accidental collision are surprisingly high: after only 26 requests, there's a 1% chance of a collision. And thanks to the birthday problem, it takes 206 requests to get to a 50% chance of collision. So maybe 30,240 is not enough for anybody.

[Advertisement] Plan Your .NET 9 Migration with Confidence
Your journey to .NET 9 is more than just one decision.Avoid migration migraines with the advice in this free guide. Download Free Guide Now!

We were just discussing TODO comments recently, and that motivated Bernard to send us this representative comment..

// TODO: This method should ideally be in tax frame work but due to // the time constraint I am duplicating the code here. // Needs to be refactored. Oct 28, 03.

This comment exists in this codebase, unchanged. It has been there for twenty three years. The refactoring has never happened.

This comment has seen the world change over the last 23 years, as the technology landscape has shifted and changed, grown and contracted. But this comment, this comment is a constant.

.comment {border: none; } [Advertisement] BuildMaster allows you to create a self-service release management platform that allows different teams to manage their applications. Explore how!

"I Already Hate Running... I Don't Want To Have To Run Each Street A Second Time!" plods WeaponizedFun "I've gotten a couple of notifications from CityStrides today that they've updated streets for several cities, but it looks like they're doubling the effort it's going to take to finish completing these roads."

"I'll be back in 292 years" concedes Rick H. "I asked GoDaddy for a single whois record. They gave it to me, and told me if I wanted to ask anything else to come back in 300 years."

Totty reports "I found this at the bottom of an article at ajournalofmusicalthings.com.

"I hope I don't have to pay the whole period" frets Ernesto T. "Not considering the mix of languages between English and Italian, my subscription will renew on 1st of Jan, 1970 So am I 56 years late in payment? I hope I am not. It would be quite a big amount of money in inflation and interests."

"Everything is insecure" worries Daryl too. "No threats found, but I don't feel very safe." It was a worrisome week.

[Advertisement] ProGet’s got you covered with security and access controls on your NuGet feeds. Learn more.

Foreign keys are an important part of making sure the entities in our relational database can be connected back together and queried correctly. It's part of proper data normalization. This isn't shocking, of course: the order line table has a foreign key over to the products table, so that every line item points to a product we sell. That's database 101. Database 201, you'd also think about the times where you have a hierarchy of records, where say, every Employee has a ManagerId, which is a foreign key back to the Employee table itself (and in database 301, you'll understand why having a ManagerId field is a terrible choice, but that's neither here nor there).

The important thing here is that foreign keys are very common, and foreign keys pointing back to the same table are also very common.

But it can still go very wrong. Roman sends us this foreign key definition in a database they maintain.

ALTER TABLE [dbo].[ListingDetails] WITH CHECK ADD CONSTRAINT [FK_Listings_Listings] FOREIGN KEY([Id]) REFERENCES [dbo].[ListingDetails] ([Id])

This ensures that the ListingDetails table's Id field is a foreign key over to the ListingDetails table's Id field. A field is a foreign key back to itself.

Roman writes: "I can't believe SQL Server even allows this..."

I can. While I haven't personally tried this out, a bit of cursory searching implies that this does actually work- the record satisfies its own constraint, so you can still add it to the database. It's basically a no-op, which isn't great, but it's not SQL Server's job to ensure you keep all your toes because they've removed all the footguns.

[Advertisement] Utilize BuildMaster to release your software with confidence, at the pace your business demands. Download today!

Alastair found this comment in his codebase, and wondered, "who wrote this comment?" A quick blame answered the question: he did. He did not, however, write the code.

public function getAllMailers() { // This function neither returns Mailers, nor all of them. ... }

I suppose the comment was easier to add that doing a global find/replace to update the function name everywhere. But I do wonder, what does this function return?

In any case, sing along: "I wrote the comment, but I did not pick this function name".

.comment { border: none; } [Advertisement] Keep the plebs out of prod. Restrict NuGet feed privileges with ProGet. Learn more.

When writing Perl, it's not unusual to want to die. The die function ends your Perl program with an error string, and you'll often see code like: die "My error" unless $i > 5 or die "Other error" if check(), because Perl just loves the backwards conditionals. What's even more fun with die is how it behaves with eval blocks, so it doesn't always kill your program, sometimes it is how you pass error strings back out of sections of your program.

And poor Bobby has inherited some Perl that just really loves to die.

public function store() { echo 'Hello'; die; if (Auth::attempt(Input::only('email', 'password'))) { echo 'done'; die; // return "welcome ".Auth::user()->username } echo "Oops! Fails"; die; return Redirect::back()->with_input(); }

Bobby didn't send the source control history here, but I have a sense of what it likely was like, once. If they authenticate successfully, print a welcome message. If they don't, redirect back to the logon page and let them try again. I suspect they wanted to disable the route. So first they disabled the success path, only to discover that the failure path kept redirecting, so they disabled that too. Finally, they added the Hello at the top to disable the whole thing.

Why? Why did they do any of this? No idea. It feels like debugging code, but you'd expect more echos and fewer dies if that were the case. And you wouldn't expect it to leak into production and sit there for years, which is what happened here.

.comment { border: none; } [Advertisement] BuildMaster allows you to create a self-service release management platform that allows different teams to manage their applications. Explore how!

"TODO" comments are an inescapable part of our work. Yes, yes, you should just do it right the first time, everything should probably have a ticket in whatever your ticket system is for visibility, but at some point, you're just going to leave a "TODO" behind.

But hopefully, the TODO gets TODONE, which is not what happened in Sam C's codebase.

function getnow() { //TODO return '2012'; }

It's the XKCD, but for years. Or WHAT YEAR IS IN memes.

At least it's a relatively recent year, not some far off point from over a decade ago.

Wait. 2012 was how long ago? That can't be right. It was just a few years ago!

.comment { border: none; } [Advertisement] Plan Your .NET 9 Migration with Confidence
Your journey to .NET 9 is more than just one decision.Avoid migration migraines with the advice in this free guide. Download Free Guide Now!

I do like it when submissions include the creator of the wtf, unless the specific kind of err is really spectacular and then it might be noteworthy regardless. This week we received a few who did tell us something about the responsible party. That being said, on with the party!"

An anonymous contributor shared with us this "Important order info from Ubbad HBG-ICS I", saying "I checked on Amazon but can't find order #{randnum(3)}-{randnum(6)}. This is worrisome though, because my credit card does end in **{randnum(4)}." Wild, so does mine!

"With the right translation this could say anything" observed B.J. H. sagely. "I guess they haven't translated to English yet. I especially like this: [%EXTERNAL_TRANSLATION:New gender_aware email footer body 5 privacy policy BLUE%] Can't they decide on capitalization and whether to use spaces or underscores?"

"this could go in two directions" worried undercapitalized (but aren't we all) klinsten. "well... it is a mail with my paycheck. but the label 'promotions' got me worried. do i get a promotion (nice!!) or did they apply a discount to my paycheck (less nice!!) i'm afraid to click it..."

Reader Valts S. wondered "I'm not sure where I'm supposed to track my order, but it feels like it's been censored." Or merely forgotten?

Regular contributor Michael R. took a flier with this, hedging that it's "Probably more a joke than a RWTF." But it's a little funny, so this editor will allow it.

[Advertisement] BuildMaster allows you to create a self-service release management platform that allows different teams to manage their applications. Explore how!

Pierre found this cry for help:

for (j = 0; j < DISTRICT_CARDINALITY; j++) { /* * A poor way to work around some sort of memory * violation. k gets clobbered, so I buffer l with it. * Help? */ for (k = 0, l = 0; k < customers; k++, l++) { /* c_id */ FPRINTF(output, "%d", l + 1); METAPRINTF((output, "%c", delimiter));

Honestly, I'm always a little worried in C-like languages when the loop variable isn't scoped to the loop and declared in place. Always concerning, so when there's concerns with clobbering, I'm not surprised.

This iterates across a set of "districts", and then iterates across a list of customers. Standard output functions are replaced with macros, and honestly, I don't know that I want to know what happens in METAPRINTF.

But fine, this iterates across a bunch of stuff and generates output. It's the comment that we're really curious about. "Some sort of memory violation", so we duplicate our loop variable. What on earth could be happening here?

Well, Pierre found the "memory violation", which is probably what you expected:

k = strlen(someOutputString) - 8;

k is used elsewhere in the loop as a variable. That's not a memory violation, that's just how variables work.

This leaves us with one possible conclusion: the developer who wrote the comment couldn't find this bug. And given the weird use of macros here, I'm going to go out on a limb and guess that it's not the developer's fault; I strongly suspect the loop is so long, so complicated, and so obfuscated that very few developers could find that.

My earlier complaint about scoping the variable to the loop wouldn't fix this, which I guess is on me. They still should really scope the variable to the loop.

.comment { border: none; } [Advertisement] Keep all your packages and Docker containers in one place, scan for vulnerabilities, and control who can access different feeds. ProGet installs in minutes and has a powerful free version with a lot of great features that you can upgrade when ready.Learn more.

We still get a fair bit of old school ASP .Net webforms code, which was cutting edge about twenty years ago, but remains a collection of bad choices that tried to make web programming feel like desktop programming. As an aside, what a reversed world we live in today, where everyone uses Electron and our desktop programming feels like web programming.

In any case, Thomas sends us some pretty ugly webforms code.

Me.Session("Albumid") = CType(e.Item.FindControl("lblAlbumID"), Label).Text If Not Me.Session("Albumid") Is Nothing And Not Me.Session("Uid") Is Nothing Then Me.strDelSQL = "Delete from tbl_Albumshare_Mast where Album_Id=" & Me.Session("Albumid") & " and Sharer_ID=" & Me.Session("Uid") Me.objDB.ExecQry(Me.strDelSQL) Me.Response.Redirect("frmmyalbumshare.aspx", False) End If

Broadly, the goal of this code is to take an album ID from the user and delete an album from the database where the ID matches and the album is owned by this user. And everything is horrible here.

First, the use of e.Item.FindControl to look up the input field is suspicious. That's usually what you do when you've dynamically generated controls, but I don't think that's happening here. Because we use FindControl we have to cast it to Label, and only then can we get the text property. That itself raises a question, because why are user inputs getting stored in a label?. That's not what labels are for. They're clearly doing some sort of hacky lookup/autocomplete field thing and using the label to actually store the input, but presenting the user with a different UI for picking it. Not an uncommon pattern in those days, but a hidden field would be a more typical way of doing it.

We then construct a SQL injection vulnerability and run it against the database.

Then, we use a redirect to send the user to a different page. Again, a common thing to do back then, but a thing I hate: using HTTP 300 codes to redirect users as a form of navigation is awkward and weird.

Of course, none of that is precisely the WTF here. The real WTF is the developer apparently hates local variables. strDelSQL is a member variable- why do we need to store this in a class member? Especially because in the page lifecycle, we handle one request and then die; either this is unnecessary, or far, far worse, some other code is looking at this SQL query later. But far worse than a badly scoped variable is the overuse of session variables.

Thomas sends us this block as a representation, but the developer responsible just stored everything they could in a session variable. While in this example, "Uid" probably makes sense, "Albumid" definitely doesn't. And in other cases, basically every user form input gets stored in a session variable, and even worse: they're often used as loop variables. while Session("myloop") < 5 type stuff.

And finally, we already know I hate hungarian notation, but here we have a client side form holdover that pollutes the user experience: the URL they get redirected to has a hungarian frm prefix. It's bad enough that you're using hungarian notation, but don't show that to your users! They really don't need to see everything.

[Advertisement] Keep the plebs out of prod. Restrict NuGet feed privileges with ProGet. Learn more.

A bit ago, I broke with my usual pattern and wrote up some security issues that I felt were particularly funny. It was a change of pace, a different thing, but not a thing that'd become a habit. After all, I'm not a security expert, this isn't a security site, and seriously, what are the odds that suitably funny security issues would crop up again less than a week later?

Well.

Let's start with the actual serious issue, PHP2Shell. In terms of scope, every version of PHP for the past twenty years has had this bug. The general issue that permits the exploit was known about, but wasn't considered exploitable.

Oops.

The broad strokes of the bug is that it's two separate bugs. The first allows someone to bypass the checks on a request's size, thus giving them a direct route to triggering an out-of-memory error. The second is that, depending where you are in the processing pipeline, PHP doesn't properly handle cleanup, allowing for use-after-free that can trigger code execution. It doesn't matter what code you've written, this all happens before the request even hits your code.

Bigger oops.

This bug was found via LLM tools, which has lead to a lot of hype around the idea that we've entered some new era. I'll certainly grant that the ability to throw compute at hacking challenges instead of human effort is going to shift the landscape, but I'm not quite willing to buy the apocalyptic prophecies. Especially when some of those prophets are telling us that their AIs will avoid deletion by copying themselves onto your thermostat. I think it's safe to say we're going to see a lot of security incidents coming out of LLMs in the near future, not because they're magic genius hackers, but because they're pretty good at processing structured text and running tests.

For those of us living in the real world, the concern isn't AIs, but HIs: human intelligences. In this case, the exploit was discovered back in August. Security researchers and the PHP Foundation put their heads down to work on it, and where necessary, notified so-called "critical infrastructure providers" to ensure that everyone was ready to address the issue. The problem there is that two people can keep a secret if one of them is dead, and a lot more than two people got roped in to deal with this.

Rumors were circulating in security circles. And cybersecurity firm Chainguard decided this was good enough excuse to break the embargo and announce the flaw before patches were available. No patches for a flaw that impacts 20 years worth of software versions of widely deployed software.

Patches are out now, though only for versions 8.2 and up. Source patches are out back to 7.4, which is officially end-of-life, but I have to wonder how many official EOLed copies of PHP are out there.

On a lighter note, we can't let the hijinks of eMudhra pass without comment. eMudhra is, among other things, a root certificate authority. They've got a bunch of key pairs that they use to sign certificates for other customers, thus vouching for those customers' identity. As a root CA, they were trusted by pretty much every TLS/SSL implementation on Earth; if you had a certificate from eMudhra, every browser would trust that you were who you said you were.

The only problem? One of their private keys was 4. Yes, it's the XKCD.

Now, in their defense(?), eMudhra didn't generate impossibly insecure keys. They performed a key signing ceremony and generated appropriately strong keys. Then they used an in-house tool to pack/unpack the keys, and this tool decided to truncate some of them down to one byte. Shockingly, even though ECC has relatively short key sizes, 8-bit ECC isn't secure! You could derive the private key from the public key using only pencil and paper. But the worst part is that they did check the validity of the keys- before they got truncated, giving them a false sense of security.

The good news, for eMudhra, is that this particular key signing ceremony generated a total of 24 keys, and only 8 of them were truncated to the point of uselessness. I have it on good authority that two out of three ain't bad.

Now, after that disgrace, it's no surprise that eMudhra is dropping out of the certificate authority business. Still, the press release where their chairman explains the rationale is some serious "screw you guys, I'm going home," energy.

He added that global SSL/TLS is a small part of eMudhra’s business contributing to about 1% of the global revenue. Due to increasing data sovereignty & compliance requirements, complexity and cost associated with this business is increasing over the years. This, paired with the fact that some of the large entities issue the SSL/TLS free of cost, the business potential and RoI of this line of business also has considerably reduced for eMudhra when measured against our cumulative revenue base.
However, the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business. In view of this, after detailed deliberations our board has concluded that withdrawing from global SSL/TLS is the right decision for eMudhra and its shareholders. For many certifying authorities, SSL/TLS is the whole business. For eMudhra it is one part of a much broader digital solutions portfolio. We will put our energy where we create the most value for customers with Sharpened Focus on Core Enterprise Solutions and trust services other than SSL/TLS.

eMudhra's chairman added "There were no end entity certificates issued out of the affected CA’s. Its infrastructure was not compromised and no data was breached. All physical and logical security controls remained intact." That's thin sauce, of course, because while eMudra may not have issued any certs under the broken keys, anyone else could have. It's not that everyone is overreacting to a non-event, and more that it's a non-event only through sheer luck.

Also, removing a root CA from your trust store isn't a trivial task, and at the time of this writing, there's still loads of cleanup that needs to happen as a result of this.

Something I learned while writing this is that eMudhra's slogan is "Trust Delivered". This is sorta like when my partner and I tried to get a coffee table delivered, and instead received a cardboard box full of wooden shards, because apparently someone though "air freight" meant "wait till the plane is roughly over my house and push the box out the back". Something was delivered, but it wasn't a coffee table by the time I got it.

[Advertisement] Keep all your packages and Docker containers in one place, scan for vulnerabilities, and control who can access different feeds. ProGet installs in minutes and has a powerful free version with a lot of great features that you can upgrade when ready.Learn more.

Submitter Chops relates a tale of chasing "The Standard" at any cost:

A company had been forced, kicking and screaming, into the 20th century, and then into the 21st. Their range of dumb hardware was no longer being bought by customers who expected at least some way to get the data off it, and a USB stick wouldn't cut it.

The techno-fearful hired an external IT company and instructed them to ensure that the company adhered to the UK's "CyberEssentials" programme of IT security.

Unfortunately, this meant that the nascent software development capability was immediately hamstrung, as people were denied the right to install and run unapproved software (including software that needed admin level rights in order to work, such as process monitor tools used as standard in software dev and test), could not easily connect across networks (also vital for the software dev), could not add various hardware to the network (such as the company's own products, which made testing them awfully difficult) and so on.

A criminal underworld of mystery PCs slowly grew into place, plugging into the network to get things done, disavowed by anyone who saw them. Tunnels grew up, IP addresses were handed round on notepaper (no DNS approvals), a shadow world of software development in the back alleys of the network. Until finally it was too much, and approval was given for a second, less secure network. The plan was that the real core business, the really important parts, they would stay on the high-security side. There would be a second network, with a single bridge, which would serve the various software development and test systems, and also host the myriad new internal services growing up (wikis, servers, tools and so on). This way, the real core business would definitely remain secure, and compliant, and the software side of it and all that would not compromise the heart of the business.

The heart of the business ended up being a network share containing a decade of out-of-date, unsearchable documentation for products that were mostly no longer sold. It is super-secure, and the business heads confirm whole-heartedly that the company adheres to the CyberEssentials programme 100% with zero compromise.

There's just a carefully separated set of servers and PCs, not the true core of the business but about eight times the size and full of essential activity, on a secondary network.

[Advertisement] BuildMaster allows you to create a self-service release management platform that allows different teams to manage their applications. Explore how!

Usually I have to save up a few weeks' worth of error'ds to get five of a kind, but this week we got a rash of funky date entries! I guess we were due.

First up Tim R. reminding us here that "Dates are difficult! ...but when the entire purpose of your web site is to convert the time to different time zones, I'm not inclined to give you much slack for being one hour out."

And an anonymous reader who just doesn't trust big tech. "In my calendar I have a monthly reminder to clear my data MS data manually. Now you know why, although I don't expect this will come as a surprise to anyone." Note the date on the lower right of the screenshot.

"June has 30 days, so 31 was not accepted," repeats Daniel D. incredulously. "I needed to calculate day difference between two dates. So I entered June 30 (as shown) only to get this error message. Now - should I trust that calculator to calculate date differences, what you say?"

Daniel D. went on to share with us a couple of images from "A well-known e-commerce website in Central Europe that allows you to filter by battery life! Only it randomly switches to seconds." Yes, randomly. See the second image too.

And finally this week, Marc Würth identified a novel Network Solutions Domain History Date Format(TM) "In other places, they displayed dates formatted as "01/13/2025", for example. I guess, instead of using actual ISO 8601, they just flipped the order and replaced the slashes with dashes."

[Advertisement] Keep all your packages and Docker containers in one place, scan for vulnerabilities, and control who can access different feeds. ProGet installs in minutes and has a powerful free version with a lot of great features that you can upgrade when ready.Learn more.

We all love format strings for generating human readable text. Certainly, they're a better choice than string concatenation. Even if I have a blind spot that keeps me from remembering the printf format tokens, I still prefer to use format strings.

Jasmine has a co-worker that does use format strings, but they also miss using string concatenation. So they've found a way to combine them, and avoid the perils of making readable code that describes the format of their text.

myField.DataFormatString = "{0:#,##0." + new string('0', 2) + ";(#,##0." + new string('0', 2) + ")}";

Now, in their defense, I can see how this code started its life. At some point, they wanted to make the number of decimal places a parameter. And sure, this is an easy way to do that and retain the intent, though this whole thing could be cleaned up with just a simple decimalPlaces = new string('0', 2), which would make the concatenation less confusing to read.

Related, while I was checking the documentation on the .NET formatting strings, I learned that they have a per-mille format specifier which requires writing a unicode sigil on most keyboards.

I'm sorry, but seeing string perMilleFmt = "#0.## " + '\u2030'; in my code would be TRWTF.

[Advertisement] Picking up NuGet is easy. Getting good at it takes time. Download our guide to learn the best practice of NuGet for the Enterprise.

Today's code maybe isn't much of a WTF, but it does point in the general direction of, "Damn, you live like this?" Poor Nancy unfortunately does.

int x = 3; int y = 4; int z = 4; x = y = z;

Each variable is declared and initialized, and then they're set equal to each other. It just raises the question though, why do it this way? Why not declare them and then x = y = z = 4, if we want that? Or maybe, for more clarity, int x = DEFAULT_VALUE; would be more legible, and we can skip the multiple assignments on one line. Why does x get set to 3 but then overwritten?

[Advertisement] ProGet’s got you covered with security and access controls on your NuGet feeds. Learn more.

At my employer, we use a service called Coveralls, which is a code coverage reporting tool that hooks into your CI pipeline. It takes your lcov reports and gives you some insights, and also makes it easy to cause the CI pipeline to fail if newly added code doesn't have reasonable coverage.

I have no strong feelings about the tool, but on February 24th, our CI jobs started failing, and our CI step that talked to Coveralls was the culprit. Coveralls had gone down. That happened to us, and a lot of other people. It was a widespread outage impacting anybody who used their service.

Coveralls actively published updates as the outage dragged on, and boy, did it drag on. Between them posting nearly identical updates minutes or even seconds apart and the general desperation that snuck into their outage notes after the first few days, I couldn't help but find their notes hilarious.

They've published their post-mortem, and the short version is that despite them paying their bills, Amazon decided they hadn't, and shut down their services. But it took them roughly 68 hours to figure that out.

If you scroll down past the post-mortem, you can see their outage notes. This is an unauthorized, dramatic reading of those notes. We've taken some liberties in interpreting it.

I hope this is taken in a good spirit, because they were just doing their best when this happened. I don't think most companies would be able to maintain operations when their cloud provider decides to lock their accounts. But I don't care who you are: begging your users to email you if they can help you migrate off AWS is funny.

[Advertisement] Utilize BuildMaster to release your software with confidence, at the pace your business demands. Download today!

Taxes are a royal pain for everyone. Amazon has found a unique way to make them even worse, as Kris W. attests:

I recently bought a €9.61 kitchen knife on Amazon Spain. My card was charged €7.94 instead. After some investigation, I discovered that Amazon had applied an old VAT registration number I'd added to my personal account years ago, and had classified my purchase as a VAT-exempt intra-EU business transaction. The invoice even contained my business address from 2022, which no longer appeared anywhere in my account settings. I just wanted to remove the VAT number so I could go back to buying kitchen utensils without accidentally generating international tax paperwork.

Unfortunately, Amazon no longer provided any visible way to manage that VAT number. Their customer support chatbot insisted I provide the order number from which I wanted the VAT number removed. A human agent confidently explained that I must have entered it into a secondary address field, and instructed me to delete and recreate my shipping address. Another support representative sent me an extensive list of documents I'd need to provide, including my passport, airline boarding passes, proof of export outside the EU, or my NATO identification card. Apparently removing a VAT number from an Amazon account is a process normally reserved for international travelers, Andorran residents, and military alliances.

Eventually, I found Amazon's official help page. It explicitly stated that VAT numbers could be removed either by contacting Customer Service or by creating an Amazon Business account to use the self-service option. After another round of correspondence, Customer Service informed me that they were not allowed to remove VAT numbers and instructed me to use the Business settings that my personal account didn't have. So I followed the documentation and created a Business account using my existing email address. During registration, Amazon required me to enter the very VAT number I was trying to remove, then promptly congratulated me by email on successfully adding and activating it.

But I couldn't access the Business settings yet. Amazon couldn't verify my business and demanded official documentation, so I obtained two freshly-issued certificates from two separate Spanish government agencies to prove that I was, in fact, a self-employed software developer. I uploaded both documents and waited. Eventually, my shiny new Amazon Business account was approved. I now had a separate Business account, complete with its own purchasing features and complimentary Business Prime membership. At last, I could navigate to the promised VAT-management page!

The page displayed my VAT number, confirmed it was valid, and offered a button to add more tax information. Beside the existing number, however, there was no Edit button. No Delete button. No self-service removal option whatsoever. There was only a link saying, Contact Customer Service to change your tax ID.

Naturally, the link led to a generic help center. After creating an entire business account, submitting government paperwork, and successfully registering the same VAT number a second time, I had arrived precisely where I started: Customer Service, which had already explained that it was not allowed to remove VAT numbers.

[Advertisement] Picking up NuGet is easy. Getting good at it takes time. Download our guide to learn the best practice of NuGet for the Enterprise.

Dr. Doom...scroller titled this one "Scrollbar-ception". Said he "Screenshot of the TikTok webpage (i.e. in a desktop browser) while not logged in. I swear this wasn't a NSFW TikTok video, instead it was a montage of some live show from some singer. Anyway... Back on the topic of the actual publishable snarky comments: Social media is known for doom-scrolling. Well, these are scrollbars of doom. Or doom-scrollbars."

An anonymous reader clarified "I was reorganizing the document by drag-and-dropping a bunch of table cells a bit too far for Word's comfort and it's telling me what I did wrong." Clearly.

B.J. H. reported a crisis. "First Southwest made me question the existence of my bags: I saw them scanned but the bag tracking system said there were no scans. Then the next page made me question my own existence as well." B.J. who?

Adam R. reported a new way of formatting numbers. "Stripe has decided "You know what, I'll put the +/- sign for the transaction amount on the *previous* line instead of the same line, just for funsies." Less snarkily: line break algorithms are fickle, and they forgot to put a non-breaking space in there."

Peter S. proposed "I was trying to sell my Peleton equipment on their official "Repowered" site, and I was shown this nice list of yes/no buttons. I am not sure if I feel like gambling today with these answers." I want to know if Peter is unloading all his equipment because he reached his goals, or if he just gave up.

[Advertisement] BuildMaster allows you to create a self-service release management platform that allows different teams to manage their applications. Explore how!

We don't cover a lot of security issues here, simply because they're not usually funny. But sometimes, they are. So here's a quick hit about some recent ones.

We start with a very bad month for the Danish social security system, the Central Register of Persons (CPR). Last week, they detected a breach which exposed the personal details of 8.8m people. Per the Register article, a cybersecurity specialist correctly pointed out that treating your ID number as if it were a secret was a terrible idea in the first place, but unfortunately, so many systems have grown up around the idea that full knowledge of your state issued ID number as proof of identity, that the security expert is screaming into the wind. They're right, but it's going to take a lot to change.

Okay, Denmark's social security service was hacked. What's so funny about that?

Well, the mechanism of the hack appears to go thusly. First, third party companies have access to the database, which they can use to send notifications to their customers via CPR. That connection is secured with a password, and one of those third parties secured their account with the kind of password you'd use to protect the precious air of the planet Druidia. Also known as the kind of password some idiot would put on their luggage: "123456". (paywalled, Danish article).

The hacker accessed the system on September 10th, and spent ten days searching through the system. The intrusion wasn't detected until October 2nd, when CPR went to send an invoice to the third party company and noticed, "Boy, that's more searches than they have customers." Now, obviously, CPR should have never even allowed such a low complexity password, but also, the third party company shouldn't have used such a low security password.

Now, if you'll excuse me, I have to change the combination on my luggage.

In other news, I'm not particularly fond of blockchain stuff. Mostly, the whole distributed ledger seems like a solution in search of problems, and "trading tokens as if they're money" is the best thing anybody's been able to come up with. Back in my consulting days, when blockchains were all over the news, I was consulting with a large retailer, and they were exploring using blockchain in their supply chain. "How does that work?" I asked innocently. "It'll have blockchain in it." "Sure, but what does the blockchain get you?" "We'll be using blockchain. If there's like, an e. coli outbreak, we can trace where it came from." "Couldn't you get that out of a regular database?" "But this'll have blockchain."

In any case, blockchain companies getting hacked and having all their users' assets stolen is practically a daily occurrence. Not really notable. But a recent hack is legitimately interesting.

A company, called Ledger, sells "hardware wallets". Instead of storing your keys on some third party's servers (where it'll get hacked and you'll lose all your "money"), you store them on a hardware device that you put in a safe. It's not connected to the internet, and thus is unhackable. Or so you'd think. But if enough people are buying those devices, a supply chain attack becomes potentially very lucrative. And that's exactly what happened. Someone in the supply chain cracked a bunch of these devices open, and inserted new hardware. They attached a microcontroller to the screen leads, that allowed it to read what was on the screen (and thus detect when the screen was displaying a recovery code that could be used to access the wallet), and a cellular modem that allowed it to literally phone home with that information.

In total, these hackers walked away with the equivalent of nearly $100M in cryptocurrency.

All the devices passed through Ledger, where they were inspected before being sold. Presumably, they were sealed with tamper-resistant packaging. It's plausible that the tamperer was downstream from here and the customers didn't fully inspect the packaging. Even your most savvy user generally doesn't check that kind of thing, and I suspect a lot of these customers aren't actually all that savvy. But also, companies in the crypto space tend to be... we'll say, more eager than cautious, so I wouldn't be surprised if the tampering happened upstream and didn't get caught by their inspection process.

Security is hard in the best case. It's much harder when you're putting the final onus of security on end users who may have thousands or even millions of dollars locked behind a single key. Or when passwords are hard, so you pick an easy one to remember.

[Advertisement] Plan Your .NET 9 Migration with Confidence
Your journey to .NET 9 is more than just one decision.Avoid migration migraines with the advice in this free guide. Download Free Guide Now!

Mandy's co-worker recently learned about virtual inheritance in C++. It's become their new favorite button to push, and they only use virtual inheritance.

Virtual inheritance is one workaround for the "diamond problem", where you have an inheritance tree that "recombines" via multiple inheritance: when a child class has a Hapsburg-esque parentage, it's hard to decide which inherited methods are being invoked or overridden.

In C++, imagine you have class A, which gets derived into classes B and C. Class D then uses multiple inheritance to inherit from B and C. In practice, this means that D inherits from A twice, and would have two internal copies of all of A's members.

If, on the other hand, you have B and C inherit virtually (class B : public virtual A), then class D will only actually inherit a single copy of A.

If you're reading this and going, "Boy, this just sounds like another reason to avoid multiple inheritance," you're probably right. The important thing, though, is inheriting virtually impacts how your child classes will inherit. It only matters if you have child classes.

Which brings us back to Mandy's co-worker. He read somewhere that defaulting to virtual inheritance all the time was safer, so he did that all the time. All. The. Time.

Including in this case:

class SomeSpecificDerivedClass final : public virtual SomeBaseClass

The class here is marked final. It can't be inherited from. The use of virtual accomplishes nothing.

[Advertisement] BuildMaster allows you to create a self-service release management platform that allows different teams to manage their applications. Explore how!