3 ms·

I think this article misses the point that somethings are also completely right or completely wrong. For example, using string concatenation to build HTML and S

I think this article misses the point that somethings are also completely right or completely wrong. For example, using string concatenation to build HTML and SQL. This is, just about always, a very bad idea. If a team is entrenched in doing this, it's not going to be a "winning battle" to undo it. You're going to anger the devs by changing all their code or making them use new libraries or whatever, but this is the way it needs to be done. I agree that approach matters, but let's not call it "battle skills," how about "not being a dick to your coworkers" and "interpersonal skills." If software development teams really are teams, take it from sports. Sometimes the captain needs to say "this is the playbook we're using, end of story" and everyone needs to trust that they're captain for a reason.

sleepychu 10y ago
"but this is the way it needs to be done." Actually, I'd disagree. It doesn't need to be done that way and this is a good example of a battle you're likely to lose that won't really cost you anything (other than some unpleasantness hand crafting SQL queries). I'd argue that even with significant opposition, any battle that needs to be won can. "I don't think we should store all the user passwords in plaintext on the server."
- gwbas1c 10y ago
  In that situation, the correct thing to do is get 1-2 people fired, or go find another job. Life is too short to work with people that incompetent.
- heartsucker 10y ago
  Please read about SQL injection[0]. Not using a library that escapes your strings is how Bobby Tables[1] ruins your production database. [0] - https://en.wikipedia.org/wiki/SQL_injection#Incorrectly_filtered_escape_characters https://en.wikipedia.org/wiki/SQL_injection#Incorrectly_filt... [1] - https://xkcd.com/327/ https://xkcd.com/327/
  - sleepychu 10y ago
    Love that XKCD :-) Maybe I misunderstood what you had in mind when you wrote string concatenation but concatenating untrusted raw strings and using a library to construct SQL queries are not the only two ways to produce a SQL query.
  - jacquesm 10y ago
    And this is exactly how one would deal with such a situation.
- cookiecaper 10y ago
  On the contrary, if you're working with people that dense, it's very unlikely that you'll make any progress on technical grounds. It's hard even among intelligent people. The reality is that most people do not make value judgments based on objective criteria of any kind. This is true even among technical people, who rapidly build religious precepts around their nearly-arbitrarily-chosen pet technologies and then discard anyone who doesn't present with the tokens and signs of their adopted technical religion, regardless of that person's true technical ability. People make judgments based on the amount of personal trust and goodwill they have toward the person making the argument. That's the natural status. With a lot of exercise, people can partially limit the effects of this impulse, but very few train at this in any significant way. The moral of the story is that the way to win arguments is to be well-liked. It's a popularity contest. If you want people to let you do what you want, you have to make them like you. The objective merits of whatever you're arguing about are practically irrelevant.
Klinky 10y ago
What if the captain is the one who says you have to use string concatenation for HTML and SQL?
- heartsucker 10y ago
  I suppose my quick metaphor doesn't hold up under scrutiny. The point I'm trying to make is teams don't (shouldn't) let egos and feelings get in the way. Just because someone likes their code getting rolled out isn't reason to make your analysis of it with anything but cold calculation.
- facetube 10y ago
  Then you either get off the plane or die with him.

sleepychu 10y ago

"but this is the way it needs to be done." Actually, I'd disagree. It doesn't need to be done that way and this is a good example of a battle you're likely to lose that won't really cost you anything (other than some unpleasantness hand crafting SQL queries). I'd argue that even with significant opposition, any battle that needs to be won can. "I don't think we should store all the user passwords in plaintext on the server."

gwbas1c 10y ago
In that situation, the correct thing to do is get 1-2 people fired, or go find another job. Life is too short to work with people that incompetent.
heartsucker 10y ago
Please read about SQL injection[0]. Not using a library that escapes your strings is how Bobby Tables[1] ruins your production database. [0] - https://en.wikipedia.org/wiki/SQL_injection#Incorrectly_filtered_escape_characters https://en.wikipedia.org/wiki/SQL_injection#Incorrectly_filt... [1] - https://xkcd.com/327/ https://xkcd.com/327/
- sleepychu 10y ago
  Love that XKCD :-) Maybe I misunderstood what you had in mind when you wrote string concatenation but concatenating untrusted raw strings and using a library to construct SQL queries are not the only two ways to produce a SQL query.
- jacquesm 10y ago
  And this is exactly how one would deal with such a situation.
cookiecaper 10y ago
On the contrary, if you're working with people that dense, it's very unlikely that you'll make any progress on technical grounds. It's hard even among intelligent people. The reality is that most people do not make value judgments based on objective criteria of any kind. This is true even among technical people, who rapidly build religious precepts around their nearly-arbitrarily-chosen pet technologies and then discard anyone who doesn't present with the tokens and signs of their adopted technical religion, regardless of that person's true technical ability. People make judgments based on the amount of personal trust and goodwill they have toward the person making the argument. That's the natural status. With a lot of exercise, people can partially limit the effects of this impulse, but very few train at this in any significant way. The moral of the story is that the way to win arguments is to be well-liked. It's a popularity contest. If you want people to let you do what you want, you have to make them like you. The objective merits of whatever you're arguing about are practically irrelevant.

Klinky 10y ago

What if the captain is the one who says you have to use string concatenation for HTML and SQL?

heartsucker 10y ago
I suppose my quick metaphor doesn't hold up under scrutiny. The point I'm trying to make is teams don't (shouldn't) let egos and feelings get in the way. Just because someone likes their code getting rolled out isn't reason to make your analysis of it with anything but cold calculation.
facetube 10y ago
Then you either get off the plane or die with him.