5 ms·
A huge mistake, but Tumblr's staff are probably quite experienced, nonetheless. How about that gotcha though? A single character is mistakenly changed from "<"
by tjogin 16y ago
A huge mistake, but Tumblr's staff are probably quite experienced, nonetheless.
How about that gotcha though? A single character is mistakenly changed from "<" to "i" and that exposes the source code to the browser. Think about that.
- hasenj 16y agoI wonder if the 'i' has anything to do with vim
- moe 16y agoClearly they should ban vim from their development process! ;-) No, joking aside, the normal way to handle this is to have the perimeter server (nginx or varnish) catch any 5* responses and turn them into a user-friendly error-page. That way you never expose sensitive stack traces to your users. So, this is standard stuff and easy to fix. However who of us hasn't screwed up on a similarly trivial issue before? I wouldn't judge them too hard on this one, happens to the best of us.
- tjogin 16y agoThat wouldn't have caught this though, this code wasn't even executed, just sent as plain text.
- moe 16y agoNginx/varnish can also catch Content-type: text/plain (or text/php?) and treat that like a 5xx response. Yes, that's a bit of a hack, but unless tumblr needs to serve text-files (which I doubt) it's a legit safeguard.
- nikcub 16y agoI know you were kidding, removing all text editors from your production servers might be a good idea
- weinzierl 16y agoClearly they should make vim mandatory on every machine;-) I guess the 'i' comes from someone who is used to use vim but in this case using another editor.
- vidar 16y agoThat was my first thought as well, as a long time vim user I kind of cringed.
- bdlang 16y agoThis is my guess. Anyone who's used VIM for years knows that the first couple of times using a different editor, your text is littered with "i" and ":w".
- hasenj 16y agoIt could simply come from forgetting to exit from insert mode, and then coming back thinking the editor is in normal mode.
- powdahound 16y agoWell, a single character change + a developer not testing their code locally + not running high level unit tests + deploying untested code to production.
- datasink 16y agoTumblr has at least one full time sysadmin. I think it's more reasonable to suppose he made the change to a production config file, rather than a developer. A definite failing in their deployment process, but it really says nothing about the quality of the application code or developer testing.