3 ms·

I accidentally copypasted my one time login code into the amount of bill payment and my ebank didn't refuse the sixty seven million dollar payment (I caught it

by chx 8y ago

I accidentally copypasted my one time login code into the amount of bill payment and my ebank didn't refuse the sixty seven million dollar payment (I caught it before sending it). Needless to say, I don't have and never had even one percent of that money. My brother one time actually succeeded in wiring ten million euros instead of ten million forints. The exchange ratio is 1:320. Obviously the account didn't have 10M EUR on it. I just entered 300 USD as a courier tip into the food order app I just tried for the first time because I expected it'll just do 3.00 for me. I caught it before sending it. All of these are lacking this kind of defensive validation. I recognize the irony of not even knowing the terminus technicus for it despite I am a senior sw developer with decades of experience.

bambax 8y ago
I sell stuff on Amazon European marketplaces. I sometimes change the price; you have to do that on each marketplace (there are 5: UK FR DE ES IT) in the interface for sellers. The decimal separator for UK/English is the dot; in all other marketplaces it's the comma. If you put a dot where a comma is expected it's silently ignored (so for example EUR 9.99 becomes EUR 999)... but "slowly": the dot you type appears normally, and then after some periodic ajax validation, it's removed. I now know this and am careful about it, but the first few times I had my items priced at 100x their normal price, until customers emailed me to ask if this was normal. It would maybe make sense to issue a warning if the new price differed from the old price by two orders of magnitude. But there's no warning.
- noir_lord 8y ago
  I inherited a system that let you put AAA in the product price field and would persist it. Validation is hard to get right so they simply didn’t try, not even common sense. I’ve spent years thinking about the optimal way to structure validation and I’ve never come up with an approach I really like on an architectural level so I do the usual approach of simple sanity checks on the client and proper validation against business logic on the server but even that isn’t as isolated as I’d like.
SilasX 8y ago
To add another anecdote: The lead developer of bitcoin accidentally sent me a donation of 10 BTC instead of 10 USD (when it was about 300 USD/BTC). (I refunded it.) https://news.ycombinator.com/item?id=14720192#14720921 https://news.ycombinator.com/item?id=14720192#14720921

by chx 8y ago

bambax 8y ago

I sell stuff on Amazon European marketplaces. I sometimes change the price; you have to do that on each marketplace (there are 5: UK FR DE ES IT) in the interface for sellers. The decimal separator for UK/English is the dot; in all other marketplaces it's the comma. If you put a dot where a comma is expected it's silently ignored (so for example EUR 9.99 becomes EUR 999)... but "slowly": the dot you type appears normally, and then after some periodic ajax validation, it's removed. I now know this and am careful about it, but the first few times I had my items priced at 100x their normal price, until customers emailed me to ask if this was normal. It would maybe make sense to issue a warning if the new price differed from the old price by two orders of magnitude. But there's no warning.

noir_lord 8y ago
I inherited a system that let you put AAA in the product price field and would persist it. Validation is hard to get right so they simply didn’t try, not even common sense. I’ve spent years thinking about the optimal way to structure validation and I’ve never come up with an approach I really like on an architectural level so I do the usual approach of simple sanity checks on the client and proper validation against business logic on the server but even that isn’t as isolated as I’d like.

SilasX 8y ago

To add another anecdote: The lead developer of bitcoin accidentally sent me a donation of 10 BTC instead of 10 USD (when it was about 300 USD/BTC). (I refunded it.) https://news.ycombinator.com/item?id=14720192#14720921 https://news.ycombinator.com/item?id=14720192#14720921