4 ms·

It's 20 freaking 17. How can people release software with these totally elementary mistakes? Just one is bad enough, but... admin/admin?? This is easily worthy

It's 20 freaking 17. How can people release software with these totally elementary mistakes? Just one is bad enough, but... admin/admin?? This is easily worthy of a Daily WTF article to itself. And this software was written by a professional contractor - pretty sure you'd get better quality from a kid fresh out of university, because on my course, it was drilled into me - NEVER TRUST THE CLIENT BROWSER! Companies need to understand, if they want an internet presence, no matter how strong the laws are in their own country, laws don't stop a crime in progress, especially when all they need to do is send a fairly simple message to the website. Computers are dumb, they do what they're told. Giving anyone the loophole to tell them to do something you didn't intend is asking to have it exploited. Going after the messenger will solve nothing. The guy who discovered the payment flaw could easily have kept quiet, letting others discover it, or quietly told his friends, who tell their friends, ad infinitum, and suddenly the whole country is buying valid passes for a penny, costing the company a hideous amount of money. Prosecuting the whistleblower will actually hurt their bottom line.

Zekio 9y ago
"NEVER TRUST THE CLIENT BROWSER!" Isn't it mostly in multiplayer game programming where this gets said over and over "Never trust the game client" even though it should be said in all aspects of programming really
- deleted 9y ago
  [deleted]
- gargravarr 9y ago
  I would have ended at 'client' but figured it could extend to the human (although that's true too). But yes, there is still so much naivety in implementing distributed or client-server systems that they should trust input from remote sources.
voidz 9y ago
I find one of the worst arguments I come across is "it is <year>" because it doesn't actually mean anything.
- gargravarr 9y ago
  Correct, but in exasperation it's often the only thing to reach for, because programming is not a new thing, even web programming, and these are such elemental flaws that should have long been eliminated. It's just cringe-worthy they are still causing problems.

Zekio 9y ago

"NEVER TRUST THE CLIENT BROWSER!" Isn't it mostly in multiplayer game programming where this gets said over and over "Never trust the game client" even though it should be said in all aspects of programming really

deleted 9y ago
[deleted]
gargravarr 9y ago
I would have ended at 'client' but figured it could extend to the human (although that's true too). But yes, there is still so much naivety in implementing distributed or client-server systems that they should trust input from remote sources.

voidz 9y ago

I find one of the worst arguments I come across is "it is <year>" because it doesn't actually mean anything.

gargravarr 9y ago
Correct, but in exasperation it's often the only thing to reach for, because programming is not a new thing, even web programming, and these are such elemental flaws that should have long been eliminated. It's just cringe-worthy they are still causing problems.